Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Tshark has no mechanism to do that.

If you're on a UN*X, so that you have the sed command available, you could try

tshark -r test.pcap -T fields -e frame.number -e ip.src -e ip.dst | sed "a\\
" >test.txt

Note that the command really is on 3 separate lines. The newline after the a\ command is required, as is the newline after the sequence of +'s.