This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark does not display all ssl.records

0

Hi,

According to the post here:

http://www.wireshark.org/lists/wireshark-users/200909/msg00254.html

there was a feature request for printing all occurances of a field when there are multiple occurances in a single packet (in my case it's ssl.record and all other fields related to ssl). Is it already implemented?

Best Regards

asked 30 Mar '12, 06:36

korczyn's gravatar image

korczyn
6●1●1●3
accept rate: 0%

One Answer:

2

Yes indeed this has been implemented:

  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
                           aggregator
     quote=d|s|n           select double, single, no quotes for values

(from "tshark -h")

You might need to upgrade to 1.6.x

answered 30 Mar '12, 07:34

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

Thank you for your response. In deed I was using an older version!

Regards, korczyn

(30 Mar '12, 08:20) korczyn

@korczyn, I've converted your "answer" to a comment as that is how this site works, see the FAQ for details. If SYN-bit has answered your question, please accept it by clicking the check mark icon.

(30 Mar '12, 12:40) grahamb ♦