Wireshark-users: Re: [Wireshark-users] OSPF LS Aging Field - Output Question

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 6 Sep 2008 14:40:04 -0700

On Sep 6, 2008, at 4:55 AM, Barry Constantine wrote:

I am trying to us the “–T fields –e” options to get the LS Age field out of OSPF LS Update packets (and dump to text file).

The problem I am running into is that the LS Age field display filter is only an offset into the frame (i.e. frame[62:2] in this case).

That means that the LS Age field isn't a named field - it's just added with proto_tree_add_text() - so you can't use "-T fields -e" to extract it.

There are a bunch of other OSPF fields that aren't named; somebody should probably add more named fields to the OSPF dissector.