Hello,

I am trying to us the  “–T fields –e” options to get the LS Age field out of OSPF LS Update packets (and dump to text file).

The problem I am running into is that the LS Age field display filter is only an offset into the frame (i.e. frame[62:2] in this case).

When I use this command:

tshark -r ospf-pcap.pcap -T fields -e frame.number -e frame.time –e frame[62:2] -R "(ospf.msg == 4) "

I get the LS Update packets, frame number, and frame time; but not the LS Age Field (frame[62:2].

Any help would be greatly appreciated.

Thanks,

Barry