 | 1 | initial version |
Do you know a way of doing it with tshark ?
Text dissections are written by TShark to the standard output, so there is no mechanism in TShark to do that.
You could have a program that reads the -T json output of TShark and writes that out in separate files; that program would have to understand the JSON output to an extent necessary to avoid splitting a single packet's JSON between files.
