hi, any way to rename columns after tshark 4.2.0 ???

asked 2025-02-03 16:37:15 +0000

jrpcaper gravatar image

im running tshark 4.3.3, in 4.2.0 release notes the deprecation of customized column is clear. But anyways ... is there a way to rename columns when reading a pcap and doing sending the attributes to separated by character file? Thanks a lot.

edit retag flag offensive close merge delete

Comments

Can you give an example command string line that worked with version 4.2.0.

Chuckc gravatar imageChuckc ( 2025-02-04 00:07:40 +0000 )edit

The following worked before 4.2.0

tshark -o 'gui.column.format: "renamedcolumn","%Cus:s1ap.radioNetwork"' -T fields -e frame.number -e _ws.col.renamedcolumn -E aggregator="$" -E separator=/t -E header=y -E quote=d -r mypcap.pcapng

jrpcaper gravatar imagejrpcaper ( 2025-02-04 14:23:47 +0000 )edit

By "worked," what was the output? The header still looked like "_ws.col.renamedcolumn" (and not just "renamedcolumn"), I assume?

johnthacker gravatar imagejohnthacker ( 2025-02-04 23:03:03 +0000 )edit

yes correct, the output was _ws_col.renamedcolumn

jrpcaper gravatar imagejrpcaper ( 2025-02-04 23:10:22 +0000 )edit

Well, if you didn't mind that output, perhaps you would be okay with defining a macro? If you define a macro (for example, renamed meaning s1ap.radioNetwork with no parameters), you would be able to do this: tshark -T fields -e frame.number -e '$renamed()' -E aggregator="$" -E separator=/t -E header=y -E quote=d -r mypcap.pcapng or tshark -T fields -e frame.number -e '${renamed}' -E aggregator="$" -E separator=/t -E header=y -E quote=d -r mypcap.pcapng

I don't know if that works for you, but those two notations are possibly not worse than the _ws.col. at the front.

johnthacker gravatar imagejohnthacker ( 2025-02-06 00:42:01 +0000 )edit
see more comments