-z proto,colinfo,tcp,tcp will not be too interesting since the field tcp
itself is only an expansion and contains no values.
Instead, if you want to display say SourcePort DestPort SEQnumber and
ACKnumber
(find out the field names by clicking on them in ethereal and look in the
comment textbox)
use
-z proto,colinfo,tcp.srcport,tcp.srcport -z
proto,colinfo,tcp.dstport,tcp.dstport -z proto,colinfo,tcp.seq,tcp.seq -z
proto,colinfo,tcp.ack,tcp.ack
You can specify -z proto,colinfo,... multiple times on the commandline.
----- Original Message -----
From: "Dirk"
Sent: Wednesday, July 28, 2004 6:18 AM
Subject: RE: [Ethereal-users] Can Ethereal export in CSV format
> So I am still struggling.
> I tried the following command: tethereal -r testd -z proto,colinfo,tcp,tcp
>
> test.txt
> and am getting the results as per attached txt file.
> The -r is to define the source filename, the -z proto, colinfo and the
> tcp,tcp is suposed to allow me to add column info. The > test.txt I added
> just to pipe the output from standard out to a text file.
> Can someone show me please how the "filter" and "field" part of the
command
> are supposed to be used and what they to achieve.
> Lastly, what I really want to achieve is have an output similar to the txt
> file attached but lets say add the byte size of each frame as a new column
> in the file.
> Is this possible? How?