Wireshark-users: Re: [Wireshark-users] tshark jump to frame number

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: M Holt <m.iostreams@xxxxxxxxx>
Date: Thu, 25 Feb 2010 05:32:56 -0800
Ugh, I'm stupid...

I found what I needed:

tshark -r <filename.cap> -V frame.number==<frame number>

Sorry for the spam...

On Thu, Feb 25, 2010 at 5:24 AM, M Holt <m.iostreams@xxxxxxxxx> wrote:
Hello,

I would like to know how to use tshark to "jump" to a specific frame number.
In Wireshark, it's ctrl-g, so I am hoping that there is something similar in tshark.

I would like to be able to print a single known packet verbosely, meaning all packet information, for one single known packet.
I have tried using -T fields -e frame.number == <frame number>, but that does not give the expected results.

If this is possible, is it also possible to display more than one?  Say a list, or a range?

Thanks in advance,
Mike