Ask Your Question

seprate packet lines in tshark

asked 2018-03-26 19:33:16 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

hi. i want to separate the line of each packet in tshark. for example

frame.number ip.src ip.dst







i use this command but not work.

tshark -r test.pcap -T fields -e frame.number -e ip.src -e ip.dst -S + -V >test.txt

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-03-26 20:43:58 +0000

Guy Harris gravatar image

Tshark has no mechanism to do that.

If you're on a UN*X, so that you have the sed command available, you could try

tshark -r test.pcap -T fields -e frame.number -e ip.src -e ip.dst | sed "a\\
" >test.txt

Note that the command really is on 3 separate lines. The newline after the a\ command is required, as is the newline after the sequence of +'s.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-03-26 19:33:16 +0000

Seen: 201 times

Last updated: Mar 26 '18