Ask Your Question

Revision history [back]

Have a look at the tshark man page and in particular the many -z options. If they don't meet your needs then you may have to use the -T fields -e... options to dump out the fields you need and then post-process the output using the scripting language of your choice.