Wireshark-users: Re: [Wireshark-users] How to display identical fields with tshark

From: eymanm <eymanm@xxxxxxxxx>
Date: Thu, 6 Jan 2011 14:44:27 -0500
Is there any schedule for 1.5.0?

On Wed, Jan 5, 2011 at 6:05 PM, Sake Blok <sake@xxxxxxxxxx> wrote:


I implemented the ability to select the first, last or all occurrences of a field with tshark a while ago. It's not yet in 1.4.x, so you will have to use an automated build or wait for 1.5.0.

From 'tshark -h':

  -e <field>               field to print if -Tfields selected (e.g. tcp.port);
                           this option can be repeated to print multiple fields
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as aggregator
     quote=d|s|n           select double, single, no quotes for values

Cheers,


Sake

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe