How to specify the path or content of esp_sa corresponding to the pcap file in the tshark command
I need to use the tshark command to parse the ESP information in pcap. When I put the esp_sa file in the root directory of wireshark, yes, it can be parsed and the output contains ESP information. But I have a requirement now, I can't put it in the default directory of wireshark, because I may have two pcap concurrent parsing, so I need to specify the esp_sa file corresponding to each pcap to be parsed in the tshark command path or content of esp_sa, is there any way to do this? (I tried using -o esp.sa_file:<esp_sa_path> to add the path of esp_sa to the command, but tshark told me that this parameter is not supported)
Question is, why do you need two esp_sa files? The SA's are keyed by the {Protocol, Src IP, Dest IP, SPI} tuple, so even if you use the same file, the distinction can be made anyway.