This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to use tshark to print certain number of bytes in a packet at a specific offset

0

I have a pcap file and want to print x number of bytes starting at offset i in the packet. I can specify a filter which will match the frames based on the content of those bytes, for instance, frame[i:x] == b2f5... , but I cannot figure out how to actually print those bytes. I tried "-T fields -e frame[i:x]" but that does not print anything.

asked 08 Mar '12, 12:13

nixbox's gravatar image

nixbox
1111
accept rate: 0%