Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Output of 'tshark -T fields' with multiple occurrences of a

From: Sake Blok <sake@xxxxxxxxxx>
Date: Mon, 19 Jul 2010 19:02:54 +0200
On 19 jul 2010, at 17:03, Martin Visser wrote:

> Not saying that this isn't a good idea (being able to output repeated fields), but I suspect when it gets to stable you might get some complaints. If people use "-T fields" like they do a CSV file, they might be expecting a fixed number of columns. (Currently whether there are 0, 1 or  more instances, I think there are always the same number of commas).

Well, the fields are still separated with tabs (by default), but within a field, multiple occurrences are now separated by commas (by default). I added another option to be able to select the value of the first occurrence of the field, the last occurrence (as it was before my change) and all occurrences (the new default):

  -T pdml|ps|psml|text|fields
                           format of text output (def: text)
  -e <field>               field to print if -Tfields selected (e.g. tcp.port);
                           this option can be repeated to print multiple fields
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as aggregator
     quote=d|s|n           select double, single, no quotes for values

I think that will give everyone the granularity of control they might need. 

> You might want to think about adding this new feature only by adding a new switch (say the -E aggregator switch)

Would showing the value of the last occurrence of the field (-E occurrence=l) be a better default? That way the behavior does not change unless you specifically ask for it.

Cheers,


Sake