Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Disabling "Analyze TCP sequence numbers" in tshark

I'm trying to parse the output of tshark when reading in a pcap file.

I can do this just fine in some pcaps, but if a pcap has some suspected out of order frames, then the payload is not dumped once the tcp analysis detects a problem.

This is solved in wirshark by disabling "Analyze TCP sequence numbers" in the TCP preferences. How do I do the same for tshark when reading a pcap file?