Wireshark-users: [Wireshark-users] OSPF LS Aging Field - Output Question

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Barry Constantine" <Barry.Constantine@xxxxxxxx>
Date: Sat, 6 Sep 2008 04:55:48 -0700

Hello,

 

I am trying to us the  “–T fields –e” options to get the LS Age field out of OSPF LS Update packets (and dump to text file).

 

The problem I am running into is that the LS Age field display filter is only an offset into the frame (i.e. frame[62:2] in this case).

 

When I use this command:

 

tshark -r ospf-pcap.pcap -T fields -e frame.number -e frame.time –e frame[62:2] -R "(ospf.msg == 4) "

 

I get the LS Update packets, frame number, and frame time; but not the LS Age Field (frame[62:2].

 

Any help would be greatly appreciated.

 

Thanks,

Barry