Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

tshark display decrypted Quic Hex without using -x

Nice to meet you
tshark ( and wireshark also) sometimes does not parse Quic protocol correctly.
Please see the picture below, we can see that wireshark only display "Handshake Protocol: Encrypted Handshake Message (fragment)" and no more information inside it. in this case, i capture before quic packet arrived so does not miss any packet.
The tshark / wireshark version is : 3.6.0 (v3.6.0-0-g3a34e44d02c9) (windows 10 64bit)
The question is :
How to extract Decrypted QUIC hex ( or acsii ) data on command line from tshark without using -x.
Sure, -x argument is the esiest way but -this option can not go with -T fields and -e .
Hope i can have your advice .Many thank for your help image description