Tshark does not display all ssl.records

Question

Hi,

According to the post here:

http://www.wireshark.org/lists/wireshark-users/200909/msg00254.html

there was a feature request for printing all occurances of a field when there are multiple occurances in a single packet (in my case it's ssl.record and all other fields related to ssl). Is it already implemented?

Best Regards

Accepted Answer

2

Yes indeed this has been implemented:

  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
                           aggregator
     quote=d|s|n           select double, single, no quotes for values

(from "tshark -h")

You might need to upgrade to 1.6.x

link

answered 30 Mar '12, 07:34

SYN-bit ♦♦
12.0k●8●40●171
accept rate: 18%

Thank you for your response. In deed I was using an older version!

Regards, korczyn

(30 Mar '12, 08:20) korczyn

@korczyn, I've converted your "answer" to a comment as that is how this site works, see the FAQ for details. If SYN-bit has answered your question, please accept it by clicking the check mark icon.

(30 Mar '12, 12:40) grahamb ♦

Tshark does not display all ssl.records

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions