Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

tshark extract from 5 gig trace

hello: I have 5 gig trace file and i need to extract all the streams which has below server name on tls handshake. is there a tshark command to create a new tracefile with only those streams or is there any other way to accomplish?

tls.handshake.extensions_server_name == "outlook.office365.com".

thanks