 | 1 | initial version |
This is issue #19076.
I have an open merge request that would allow you to enter something like:
tshark -o 'gui.column.format:"No.","%m","Frame","%Cus:@frame"' -r file.pcap
in order to produce output like
1 ff:ff:ff:ff:ff:ff:24:5e:be:3b:d5:d1:08:00:45:00:00:31:4c:5d:40:00:40:11:69:da:c
0:a8:01:35:c0:a8:01:ff:c2:d6:7e:9c:00:1d:c3:7d:4d:2d:53:45:41:52:43:48:20:2a:20:48:54
:54:50:2f:31:2e:31:0d:0a
2 ff:ff:ff:ff:ff:ff:24:5e:be:3b:d5:d1:08:00:45:00:00:31:4c:5c:40:00:40:11:69:db:c
0:a8:01:35:c0:a8:01:ff:a4:08:7e:9e:00:1d:e2:49:4d:2d:53:45:41:52:43:48:20:2a:20:48:54
:54:50:2f:31:2e:31:0d:0a
| | 2 | No.2 Revision |
This is issue #19076. and I don't believe that exactly what you're asking for is possible in current releases, though it certainly is possible to produce other output, like what Chuck mentioned, and then post-process it to get what you desire (it's not that difficult to read JSON and then spit out the desired value.)
I have an open merge request that would allow you to enter something like:
tshark -o 'gui.column.format:"No.","%m","Frame","%Cus:@frame"' -r file.pcap
in order to produce output like
1 ff:ff:ff:ff:ff:ff:24:5e:be:3b:d5:d1:08:00:45:00:00:31:4c:5d:40:00:40:11:69:da:c
0:a8:01:35:c0:a8:01:ff:c2:d6:7e:9c:00:1d:c3:7d:4d:2d:53:45:41:52:43:48:20:2a:20:48:54
:54:50:2f:31:2e:31:0d:0a
2 ff:ff:ff:ff:ff:ff:24:5e:be:3b:d5:d1:08:00:45:00:00:31:4c:5c:40:00:40:11:69:db:c
0:a8:01:35:c0:a8:01:ff:a4:08:7e:9e:00:1d:e2:49:4d:2d:53:45:41:52:43:48:20:2a:20:48:54
:54:50:2f:31:2e:31:0d:0a