Peter Gordon wrote:
tshark can be used to display fields using the -T option.
If the same field occurs a number of times within a protocol,
only one value ( the last ) gets displayed.
As far as I can see the error looks like it comes from the
routine proto_tree_write_fields.
The -T pdml option gives the correct output, but is too voluminous.
Can anyone help with a fix?
There's at least one bug for that:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3818
It was discussed quite a bit at Sharkfest this year too--there seemed to
be quite a bit of interest in finding a way to fix it. (But: as
evidenced by the fact that there is so much interest and it hasn't been
done yet, it's non-trivial to implement.)
