Doug and Peter,
This is basically the same question as Damker's post which I have responded to here -
http://www.wireshark.org/lists/wireshark-users/201007/msg00108.html
Unfortunately each -e field only matches a single instance. You are
better off parsing the PDML output, that outputs all of the fields by
iterating through the field. I have created a perl one-liner that can do
this:-
tshark.exe -T pdml -r "MCNew.cap" | perl -ane
'@flist=qw(m3ua.protocol_data_opc m3ua.protocol_data_dpc
h248.transactionId);\
foreach $f (@flist) {\
if(/field
name=\"$f\".*show=\"(.*?)\".*/){print "$1,";}}'
Output is:
1307690,1307721,2046823431,1310708,1307721,1307690,1307721,3825208323,
1307719,1307721,1307690,1307721,3288337409,1307817,1307721,1307690,
1307721,2449476613,1307690,1307721,752404340,
Note
that it seems (with this protocol) that as there seems to be a variable
number of same field and some are option (for instance the second
opc/dpc set doesn't have a matching transactionId), I would include the
field name in the output so:
tshark.exe -T pdml -r "MCNew.cap" | perl -ane
'@flist=qw(m3ua.protocol_data_opc m3ua.protocol_data_dpc
h248.transactionId);\
foreach $f (@flist) {\
if(/field
name=\"$f\".*show=\"(.*?)\".*/){print "$f:$1,";}}'
m3ua.protocol_data_opc:1307690,m3ua.protocol_data_dpc:1307721,h248.transactionId:2046823431,
m3ua.protocol_data_opc:1310708,m3ua.protocol_data_dpc:1307721,
m3ua.protocol_data_opc:1307690,m3ua.protocol_data_dpc:1307721,h248.transactionId:3825208323,
m3ua.protocol_data_opc:1307719,m3ua.protocol_data_dpc:1307721,
m3ua.protocol_data_opc:1307690,m3ua.protocol_data_dpc:1307721,h248.transactionId:3288337409,
m3ua.protocol_data_opc:1307817,m3ua.protocol_data_dpc:1307721,
m3ua.protocol_data_opc:1307690,m3ua.protocol_data_dpc:1307721,h248.transactionId:2449476613,
m3ua.protocol_data_opc:1307690,m3ua.protocol_data_dpc:1307721,h248.transactionId:752404340,
Regards, Martin
Regards, Martin
MartinVisser99@xxxxxxxxx
On Mon, Jul 12, 2010 at 10:42 PM, Douglas Wood
<doug.wood@xxxxxxxx> wrote:
I have created a modified version of Wireshark in which I produce tab
delimited files that actually aggregates multiple instances of particular
fields. In fact, the output can become way too voluminous, but, it is much
faster to process these tab delimited files than the PDML output.
Especially when there are 100,000's of packets.
I will attest that the aggregation of multiple instances of a field is
pretty tricky. I wouldn't mind working with somebody else to try to
generalize what I have done.
Doug
