On Aug 3, 2012, at 12:39 PM, naresh gudipudi wrote:
> Yes, it is reading, not replaying.My mistake. I am specifying the fields with -e option. for example, the Target Address field(in icmpv6 header) in icmpv6 neighbor solicitaion message(icmpv6 type = 135) sent to solicited-node multicast address, i am specifying the filter as icmpv6.nd.ns.target_address. When this filter is used in wireshark GUI, it works. But in tshark, what all i can see is a nothing.
OK, so you have, for example, a capture file that, when you read it into Wireshark, and use "icmpv6.nd.ns.target_address" as a filter expression, it shows some packets, meaning that those packets have the "icmpv6.nd.ns.target_address" field in them, but if you run TShark with that capture file and with "-T fields" and "-e icmpv6.nd.ns.target_address", it doesn't print anything?
If so, then, if you have a capture file that shows that behavior and that you can make public by putting it into a bug, could you file a bug at
http://bugs.wireshark.org/
and attach the capture file to the bug? I have a capture with "icmpv6.nd.ns.target_address" in one of the packets in it, and when I run a recent build of TShark from the trunk on that capture file with "-T fields" and "-e icmpv6.nd.ns.target_address", it prints the target address.
