Ask Your Question

Tshark "-Tfields" option not working

asked 2018-09-18 14:42:06 +0000

Rooster_50 gravatar image

updated 2018-09-18 20:46:39 +0000

Guy Harris gravatar image

Tshark Version 2.6.3 (Windows 64-bit version)

I am trying to export the "data.txt" field to a text file with TSHARK. When I attempt the following...

tshark -r filename.pcapng -Tfields -e data.txt >> dataprint.txt

I get the following error...

tshark: Some fields aren't valid: data.txt

Is this a limitation of the current version of Tshark where data.txt is not a field that can be extracted with the TFields parameter? In the default profile, I have "Show data as text" checked in the protocol preferences.



edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-09-18 15:06:31 +0000

cmaynard gravatar image

As the error message indicates, there is no data.txt field. I think the field you're looking for is data.text.

You can check/verify which fields are valid for which version of Wireshark you're using by referencing the online Display Filter Reference page. For example, the valid data fields are currently listed as:

Field name  Description     Type    Versions   Data    Sequence of bytes   1.0.0 to 2.6.3
data.len    Length  Signed integer, 4 bytes     1.2.0 to 2.6.3
data.md5_hash   Payload MD5 hash    Character string    1.6.0 to 2.6.3
data.text   Text    Character string    1.4.0 to 2.6.3  Uncompressed Data   Sequence of bytes   2.6.0 to 2.6.3
data.uncompressed.len   Uncompressed Length     Signed integer, 4 bytes     2.6.0 to 2.6.3
edit flag offensive delete link more


Too long of week already and stared at it way too long to realize the rookie syntax mistake.

Thanks Cmaynard!

Rooster_50 gravatar imageRooster_50 ( 2018-09-18 15:37:06 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2018-09-18 14:42:06 +0000

Seen: 1,505 times

Last updated: Sep 18 '18