On Sun, Nov 16, 2008 at 01:11:50AM -0800, Maryam Homayouni wrote:
> I tried -E option but it is not as flexible as I expect, it only writes
> exactly the header name which is specified in -e option in top line of the
> file above each column, for example the following command:
> tshark -T fields -e frame.number -E header=y -E quote=d > out
> results the following output:
> frame.number
> "1"
> "2"
> "3"
> ...
> but what I am looking for is to write what ever I prefer beside the values
> in each line, for example
>
> Frame Number : 1 Time : 0.0000
> Frame Number : 2 Time : 0.0012
> ..
> can any body suggest me a way to get it?
tshark -Tfields and awk are your friends:
$ tshark -r test.cap -Tfields -e frame.number -e frame.time_delta | awk -F"\t" '{printf("Frame number : %d\tTime : %s\n", $1, $2)}'
Frame number : 1 Time : 0.000000000
Frame number : 2 Time : 1.446395000
Frame number : 3 Time : 0.023743000
Frame number : 4 Time : 1.001695000
Frame number : 5 Time : 0.962079000
Frame number : 6 Time : 0.288887000
Frame number : 7 Time : 0.041947000
Frame number : 8 Time : 0.768174000
Hope this helps,
Cheers,
Sake