Getting specific fields from packets

edit

Note that depending on the shell used you may have to quote some of the arguments, e.g. -E "header=y"

Thank you very much Cmaynard and Grahamb by your answers!

I'm trying the commands now, following this syntaxis:

C:\Program Files\Wireshark>tshark -r "C:\Capturas\20191111_14_45-MIRR-BKP.pcap" -Y "gtp.message == 0x10" -T fields -E "header=y" -E "separator=," -E "quote=d" -e "frame.number" -e "e212.imsi" -e "e164.msisdn" -e "gtp.lac" -e "gtp.sai_sac" > "C:\Capturas\huge.csv"

EDIT1: I was having trouble with a message error "tshark: The file [filename] appears to have been cut short in the middle of a packet." but realized it does not interfere with the command inner workings.

EDIT 2: I only changed the separator from \t to , to be able to open the csv on MS Excel without any further steps.

EDIT3: I'm trying to upvote your answer but the system does require >15 pts to allow it.

I really appreciate your help uys!!

You don't upvote an answer that has solved your issue, you accept it by clicking the checkmark icon to the left of it.

This also helps other folks with the same issue to quickly see which answer was most helpful.

This looks really cool!

When I want to extract data from a pcap file, I would apply the specific field as a column and then File > Export Packet Dissections > As CSV.