Ask Your Question
0

Export to text with tshark

asked 2019-05-21 15:15:16 +0000

tantal gravatar image

updated 2019-05-21 15:17:35 +0000

Hi guys, how can I export with tshark to text with all the Packet details expanded?

Prtscr of how I do it in Wireshark. http://ibb.co/k2Qp00q

edit retag flag offensive close merge delete

Comments

It looks like tshark can't read the disection:
Unknown - aborting dissection Extraneous Data

GSM A-I/F DTAP - Identity Response Protocol Discriminator: Mobility Management messages .... 0101 = Protocol discriminator: Mobility Management messages (0x05) 0000 .... = Skip Indicator: 0 10.. .... = Sequence number: 2 ..01 1001 = DTAP Mobility Management Message Type: Identity Response (0x19) Unknown - aborting dissection Extraneous Data

tantal gravatar imagetantal ( 2019-05-22 06:26:45 +0000 )edit

Arrrrrgh, after upgrade the tshark output is identitcal.

tantal gravatar imagetantal ( 2019-05-22 09:07:51 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted
1

answered 2019-05-21 17:39:32 +0000

grahamb gravatar image

From the tshark Man Page (and as output by tshark -h):

-V Cause TShark to print a view of the packet details.

There's quite a bit more about controlling output in the Man page.

edit flag offensive delete link more

Comments

-V is not as detailed as export from wireshark. I read the MAN, but just cant find an answer.

tantal gravatar imagetantal ( 2019-05-21 18:24:13 +0000 )edit

Arrrrrgh, after upgrade the tshark output is identitcal.

tantal gravatar imagetantal ( 2019-05-22 09:07:44 +0000 )edit

Note that you will probably need to add two-pass processing, -2, to tshark to get absolutely identical output as Wireshark always does two-pass, but it's an extra option for tshark.

grahamb gravatar imagegrahamb ( 2019-05-22 09:30:05 +0000 )edit
0

answered 2019-05-21 19:12:33 +0000

Guy Harris gravatar image

Use

tshark -P -V -x -r {filename}
edit flag offensive delete link more

Comments

Still not as detailed as export from wireshark. :(

tantal gravatar imagetantal ( 2019-05-22 06:16:24 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-05-21 15:15:16 +0000

Seen: 970 times

Last updated: May 21 '19