Ask Your Question

Revision history [back]

how to get output like when using -z?

I have been using this script to automatically split a pcap file into single tcp streams:

for stream in $(tshark -r $1 -T fields -e | sort -n | uniq)
    echo $stream
    tshark -r $1 -w $2/stream-$stream.cap -Y "$stream"

now, for each single capture file that represents a stream I would like to read it with the same format that you get when you follow a stream using -z, for example

tshark -r somefile.pcap -z "follow,http,ascii,,"

does some option that does this exist?