I have a few pcap files, I can see the memcache protocol in wireshark and its corresponding data, but when I use tshark to batch export data, it only shows one character(0x0b), anyone knows why? the command I use: tshark -Y "memcache contains set" -r input.pcap -T fields -e memcache.value Thank you! BTW, memcache key works fine. asked 15 Oct '16, 21:51  1a1a11a |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Is there just a single (key,value) pair per a memcached network message or more? For analysis by anyone else than the author of the dissector, an example of capture file is necessary. You can upload it to Cloudshark (which is the preferred method here) or to any generic file sharing service and edit your question with a login-free link to it.