On Tue, May 29, 2007 at 05:50:47AM -0400, Douglas F. Calvert wrote:
> Hello is there a way to have tshark print a specific field instead of
> the terse/verbose decoded output? I would like to be able to do:
>
> tshark -r file --dfc-grovel-flag wlan.bssid
>
> And have tshark print out the bssid either next to the source/address
> or instead of the src/address?
Check out the new -Tfields and -e options in the latest Wireshark
developer versions (they were added after 0.99.5 was released if I
remember correctly). The tshark man page describes them. You can get
the latest version (0.99.6 developer) from
http://download.wireshark.org/download/automated/ or you can wait for
0.99.6 to be released (no set date yet).
Steve