Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] decode from a specific frame

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Apr 2008 18:15:10 -0700
John huysing wrote:
If I have a capture file and I know the frame number(s) of the packet I want to inspect.


I want to get a detailed packet decode of that/those packet(s). Can i do this with tshark.

	tshark -V -r {capture file} -R "frame.number == {frame number}"

will print out the frame in question. You can do "frame.number == {first frame number} or frame.number == {second frame number} or ..." if you want multiple frames.