 | 1 | initial version |
In a nutshell, use a display filter (-Y) instead of a read filter (-R), e.g.:
tshark -r capture.pcap -T fields -e frame.number -e ssl.handshake.extensions_server_name -2 -Y ssl.handshake.extensions_server_name
Refer to the tshark man page for more details.