https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5968
Summary: tcp values are not printed in tshark with -T fields or
-o column.format
Product: Wireshark
Version: 1.4.4
Platform: Other
OS/Version: All
Status: NEW
Severity: Normal
Priority: Low
Component: TShark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: ml@xxxxxxxxxx
Build Information:
TShark 1.4.4
Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.28.0, with libpcap 1.1.1, with libz 1.2.5, with
POSIX capabilities (Linux), without libpcre, with SMI 0.4.8, with c-ares 1.7.4,
with Lua 5.1, without Python, with GnuTLS 2.8.6, with Gcrypt 1.4.6, with MIT
Kerberos, with GeoIP.
Running on Linux 2.6.37.6-0.5-default, with libpcap version 1.1.1, with libz
1.2.5.
Built using gcc 4.5.1 20101208 [gcc-4_5-branch revision 167585].
--
When running the following command:
> tshark -r test.pcap -T fields -E separator=';' -e frame.number -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e tcp.len | head -5
This output is obtained, notice the double ";;" and the lack of last populated
field:
1;May 18, 2011 11:40:58.754078000;10.3.48.10;;172.20.65.4;;
2;May 18, 2011 11:40:58.757426000;172.20.65.4;;10.3.48.10;;
3;May 18, 2011 11:40:58.770216000;10.45.84.164;;10.45.112.4;;
4;May 18, 2011 11:40:58.770496000;10.45.112.4;;10.45.84.164;;
5;May 18, 2011 11:40:58.880415000;10.45.112.4;;10.45.48.12;;
Similar output is obtained with the column.format argument:
> tshark -r test.pcap -R "sip" -t a -o 'column.format: "IP src ip", %Cus:ip.src, "IP src port", %Cus:tcp.srcport, "IP dst ip", %Cus:ip.dst, "IP dst port", %Cus:tcp.dstport' | head -5
10.3.48.10 172.20.65.4
172.20.65.4 10.3.48.10
10.45.84.164 10.45.112.4
10.45.112.4 10.45.84.164
10.45.112.4 10.45.48.12
It is expected that the tcp port values are shown here.
Articles on the internet show that such queries should be possible, e.g.:
http://www.clshack.it/en/tshark-command-line-of-wireshark.html
http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/
and more
Can this be fixed, please?
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.