Hi All,
I'm trying to get some process information using the fields:
tcp.proc.dstpid tcp.proc.dstuid tcp.proc.dstcmd tcp.proc.srctpid tcp.proc.srcuid tcp.proc.srccmd udp.proc.dstpid udp.proc.dstuid udp.proc.dstcmd udp.proc.srctpid udp.proc.srcuid udp.proc.srccmd
For example:
tshark -r wireshark_capture.pcapng -q -z conv,ip -T fields -E separator=, -E quote=d -e tcp.proc.srccmd -e tcp.proc.srcuid -e tcp.proc.srcpid
However my output is always blank.
Do I need to enable something first for Wireshark to capture this information?
Thanks in advance.
