Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

The transum protocol is disabled by default.


    /* Due to performance concerns of the dissector, it's disabled by default */

In the tshark man page, there is a small section "Disabled (Enabled) Protocols" which describes the disabled_protos file.

You could move transum from disabled_protos to enabled_protos or enable on the command line:

C:\>tshark -r ./dcerpc_retrans.pcapng -2 -T fields -e -Y

C:\>tshark -r ./dcerpc_retrans.pcapng -2 -T fields -e -Y --enable-protocol transum

There is an open issue (17604: tshark -G reports: add to heuristic-decodes, protocols) to add protocol status to tshark -G protocols.