Revision history [back]

Is there a way to extract the whole frame hex dump using tshark with epoch time?

I am able to run following command which provides me both of the fields (i.e. frame_raw and frame.time_epoch) I need:

tshark -r <pcap_path> -x -T json -j "frame"

However, I would like to use something like below:

tshark -r <pcap_path> -x -T ek -e frame.time_epoch -e raw

OR

tshark -r <pcap_path> -x -T ek -e frame.time_epoch -e frame_raw

Is there a way to extract the whole frame hex dump using tshark with epoch time?

I am able to run following command which provides me both of the fields (i.e. frame_raw and frame.time_epoch) I need:

tshark -r <pcap_path> -x -T json -j "frame"
"frame"

tshark -r <pcap_path> -x -T ek -e frame.time_epoch -e raw
raw

tshark -r <pcap_path> -x -T ek -e frame.time_epoch -e frame_raw
frame_raw

Is there a way to extract the whole frame hex dump using tshark with epoch time?

I am able to run following command which provides me both of the fields (i.e. frame_raw and frame.time_epoch) I need:

tshark -r <pcap_path> <pcapng_path> -x -T json -j "frame"

However, I would like to use something like below:

tshark -r <pcap_path> <pcapng_path> -x -T ek -e frame.time_epoch -e raw

OR

tshark -r <pcap_path> <pcapng_path> -x -T ek -e frame.time_epoch -e frame_raw