tshark: how to decode and display individual packets

Question

Hi All,

I want to use tshark to display the raw packets. By using the command and options: tshark -x -r file.pcap the tshark displays all the packets. I want to view the packets one by one, but can not find the option to display say the 1st packet.

Thanks in advance.

/Dan

Answer 1

You can use a display filter to only select a particular frame.number:

tshark -r <file> -x -R frame.number==1

If you want to display more than one packet, you can combine it with the -c option:

tshark -r <file> -x -c 10 -R frame.number>=100

This would show you 10 packets starting at packet 100.