try
tshark -r <pcap> -Tfields -e ip.dsfield
sample output would be like:
[root@xxxx ~]# tshark -r /tmp/LS_AuthS.pcap -e ip.dsfield -Tfields
Running as user "root" and group "root". This could be dangerous.
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
[root@xxxxx~]#
--
Sandeep Nitta
Hi All,
How I can specify in the tshark parameters list that I want to see packets' DSCP or ToS fields in the tshark's output?
Is there any field name that can be used with "-T fields" option? Or maybe any other way to print it in the output?
Thanks a lot!
aleks.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users
--
Keeping a smile on your face when inside you feel
like dying,
for the sake of supporting others
...is Strength.
Stopping at nothing and doing what's in your
heart that you know is right
...is Determination.
Doing more than is expected, to make another's life
a little more
bearable,
without uttering a single complaint
...is Compassion.
Helping a friend in need, no matter the time or effort,
to the best of your ability
...is Loyalty.
Holding your head high
And being the best you know you can be when life
seems to fall apart at your feet,
Facing each difficulty with the confidence that
time will bring you better tomorrow,
And never giving up...
...is Confidence.