Hello,
I am trying to us the “–T fields –e”
options to get the LS Age field out of OSPF LS Update packets (and dump to text
file).
The problem I am running into is that the LS Age field
display filter is only an offset into the frame (i.e. frame[62:2] in this
case).
When I use this command:
tshark -r ospf-pcap.pcap -T fields -e frame.number -e
frame.time –e frame[62:2] -R "(ospf.msg == 4) "
I get the LS Update packets, frame number, and frame time;
but not the LS Age Field (frame[62:2].
Any help would be greatly appreciated.
Thanks,
Barry
