tshark default output format differs between versions

asked 2020-03-07 10:46:47 +0000

kaos gravatar image

default output format on Windows (tshark 3.2.2):

   14 2020-03-07 11:20:12,773554 →      DNS 70 Standard query 0x0012 A google.com
   15 2020-03-07 11:20:12,798941 → DNS 134 Standard query response 0x0012 A google.com A A A A

default output format on Linux (older tshark 1.10.14):

  1 2020-03-07 10:18:59.796430410 ->      DNS 70 Standard query 0x2560  A google.com
  2 2020-03-07 10:18:59.821146788 -> DNS 86 Standard query response 0x2560  A

the new version prepends a query (A google.com), the old version doesn't. (The minor differences, like an arrow instead of "->" and comma instead of dot in the timestamp, doesn't matter for this question)

Please point to a source code file where the default output format is defined. In which version has it changed (prepending the query)? Is there a way to modify the default output to make it consistent for any version? I've tried to use Tfields with desired columns, but couldn't get the output similar to the default.

additional question: is the timestamp defined by "-t ad" depends on the country locale settings? Does is shown as "2020-03-07 10:18:59.796430410" with GB/DE locale, but looks different with the US locale?

edit retag flag offensive close merge delete