Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] mount exports

From: Peter Gordon <peter@xxxxxxxxxxxxxxxxxx>
Date: Sun, 27 Jun 2010 12:31:17 +0300
I am trying to use tshark to dump some of the contents of a frame. In
particular, I issued an rpc call to EXPORT. I get a reply with a
hierachy:

Mount Service
  Export List Entry
    Directory 
     contents

This grouping recurs a number of times in the frame. I want to know how
to dump _every_ occurrence of the contents field in the frame.

I have tried 
tshark -n -r a.cap -T fields  -e  mount.export.directory 
but it just prints one entry per frame, not all of them.

Thanks,

Peter