Christopher Maynard <Chris.Maynard@...> writes:
> > > Any thoughts? Or am I out of luck?
> >
> > You might be able to use something like: tshark -R "frame contains FOO"
> > or even: tshark -R "sdp.media_attr && frame contains FOO"
>
> Of course that will only help you find the packets that contain what you're
> looking for, but it won't print the fields, so you could also try using "-V" to
> print out all the packet details, redirect the output to a file, then grep for
> your matching "Media Attribute" lines that way?
Another possible alternative - use the latest tshark that supports "-E
occurrence=a", but run it on another host doing remote packet capture?
http://www.winpcap.org/docs/docs_412/html/group__remote.html
http://wiki.wireshark.org/CaptureSetup#Step_5:_Capture_traffic_using_a_remote_machine