Wireshark-users: Re: [Wireshark-users] tshark -T fields and info column

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: wireshark@xxxxxxxxxxxx
Date: Sun, 25 May 2008 06:58:40 -0700 (PDT)
> On 24. mai. 2008, at 20.25, wireshark@xxxxxxxxxxxx wrote:
>
>> Is it possible with tshark to output the regular column info (I'm
>> interested in the %i info field in particular) while also outputting
>> fields using -T fields with -e.
>
>
> You can overwrite the column format with custom columns like this:
>
> tshark -o column.format:'"No.", "%m", "Info", "%i", "Len",
> "%Cus:tcp.len"'
>
>
> --
> Stig Bj�rlykke
>

Thanks Stig. I've playing with this and I think it will work fine,
although I seem to lose the ability to use tabs or another character as
field delimiter. With the delimiter, the -T fields format is more
parsable, but the % fields in column.format are just too useful.

E