Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How to specify the path of esp_sa corresponding to the pcap file in the tshark command

I need to use the tshark command to parse the ESP information in pcap. When I put the esp_sa file in the root directory of wireshark, yes, it can be parsed and the output contains ESP information. But I have a requirement now, I can't put it in the default directory of wireshark, because I may have two pcap concurrent parsing, so I need to specify the esp_sa file corresponding to each pcap to be parsed in the tshark command path or content of esp_sa, is there any way to do this? (I tried using -o esp.sa_file:<esp_sa_path> to add the path of esp_sa to the command, but tshark told me that this parameter is not supported)

How to specify the path of esp_sa corresponding to the pcap file in the tshark command

I need to use the tshark command to parse the ESP information in pcap. When I put the esp_sa file in the root directory of wireshark, yes, it can be parsed and the output contains ESP information. But I have a requirement now, I can't put it in the default directory of wireshark, because I may have two pcap concurrent parsing, so I need to specify the esp_sa file corresponding to each pcap to be parsed in the tshark command path or content of esp_sa, is there any way to do this? (I tried using -o esp.sa_file:<esp_sa_path> to add the path of esp_sa to the command, but tshark told me that this parameter is not supported)