Revision history [back]

From the tshark manpage:

-T ek|fields|json|jsonraw|pdml|ps|psml|tabs|text Set the format of the output when viewing decoded packet data. The options are one of:

...

fields The values of fields specified with the -e option, in a form specified by the -E option. For example,

tshark -T fields -E separator=, -E quote=d

would generate comma-separated values (CSV) output suitable for importing into your favorite spreadsheet program.

Note that you specify the fields required with multiple -e fieldName options.