Actually after doing it exactly as you did I have understood that the problem is in the –w directive.

When using the standard output the tree is shown as you have mentioned.

If I use –w filename there is no protocol tree in the saved file.

Strange but as usual it must be something that I am doing wrong. Any idea what that might be please?

Tal

Thanks Mr. Blok,

I was actually trying to do it this way, and just in case added now the –R option as you had it:

tshark -i 4 -w c:\_LAB\out.cap -R http.request –V

But I get in the output file only raw compressed HTTP data, and not the full tree. Do I need to configure something else in the environment to make it work?

Thanks,

Tal

From: "Sake Blok" <sake@xxxxxxxxxx>
Date: Mon, 2 Mar 2009 12:20:00 +0100

…

Hi,

I am fairly new and am still learning the basics.

I am trying to use tshark for background only capturing and analysis (no display needed\wanted).

I am seeing in the captured stream only the pcap protocols such as TCP.

My need is to dissect the packets also for all the additional protocols as supported in the Wireshark UI (HTTP, FTP, TELNET …).

Is it possible through tshark (or any other non UI way)?

Thanks,

Tal