Wireshark-users: Re: [Wireshark-users] How can I obtain the application layer protocol using "tsh
From: sandeep nitta <sandeep.nitta@xxxxxxxxx>
Date: Wed, 2 Sep 2009 16:12:14 +0530
snitta@snitta-laptop:/root/pcaps$ tshark -r msn.pcap -Tfields -e frame.protocols eth:ip:tcp:data eth:ip:tcp:data eth:ip:tcp eth:ip:udp:nbdgm:smb:browser eth:ip:udp:nbdgm:smb:browser eth:ip:udp:nbdgm:smb:smb_netlogon eth:ip:udp:nbdgm:smb:smb_netlogon eth:ip:udp:nbdgm:smb:smb_netlogon eth:ip:udp:nbdgm:smb:smb_netlogon eth:ip:tcp eth:ip:tcp But not sure, if this is what you are looking for. On Wed, Sep 2, 2009 at 7:43 AM, Martin Visser<martinvisser99@xxxxxxxxx> wrote: > Not 100% sure, but I have a feeling the best you can do is "-e > "frame.protocols" > > I don't believe the Protocol (or Info for that matter) column can be > extracted here. > > Regards, Martin > > MartinVisser99@xxxxxxxxx > > > On Mon, Aug 31, 2009 at 10:15 PM, Daniel Schlosser > <schlosser@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote: >> >> I'm using "tshark ... -T fields -e ..." to extract information about >> the packets of a captured file. >> Unfortunately, I couldn't manage to get the protocol, which is >> displayed using the -T psml option. >> Is there any -e ???? option to get this information? >> >> Best regards >> Daniel >> >> >> ___________________________________________________________________________ >> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx> >> Archives: http://www.wireshark.org/lists/wireshark-users >> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users >> >> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe > > > ___________________________________________________________________________ > Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx> > Archives: http://www.wireshark.org/lists/wireshark-users > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users > mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe >
- Follow-Ups:
- References:
- Prev by Date: [Wireshark-users] compiling static tshark binaries with wireshark 1.2.1 on solaris x86
- Next by Date: Re: [Wireshark-users] Netmon 3.3 capture in Wireshark 1.2.1
- Previous by thread: Re: [Wireshark-users] How can I obtain the application layer protocol using "tshark -T fields -e ??"
- Next by thread: Re: [Wireshark-users] How can I obtain the application layer protocol using "tshark -T fields -e ??"
- Index(es):
