 | 1 | initial version |
I'm using tshark to collect a series of fields from a large collection of pcap files. Outputting the fields from the pcap is fine - I'm using the "-e" option to specify each of the fields names I need. The part missing is a way to output the filename of the pcap.
Is there a field name that corresponds to the pcap filename? Checked the fields reference here, but don't see anything.
I'm using a program that executes tshark to collect a series of fields from a large collection of pcap files. So internally it fires up tshark for each pcap file in turn.
Outputting the fields from the pcap is fine - I'm using the "-e" option to specify each of the fields names I need. The part missing is a way to output the filename Most of the pcap.time that is just fine, but I have a use-case where I also need to know the name of the pcap where there field data came from.
Is there a field name that corresponds to the pcap filename? Checked the fields reference here, but don't see anything.
If it doesn't exist I can change the program to get it to output the filename.
