Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Output of 'tshark -T fields' with multipleoccurrences of a

From: "Boonie" <newsboonie@xxxxxxxxx>
Date: Thu, 15 Jul 2010 20:29:18 +0200

----- Original Message ----- From: "Sake Blok" <sake@xxxxxxxxxx> To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>; "Developer support list for Wireshark" <wireshark-dev@xxxxxxxxxxxxx>
Sent: Wednesday, July 14, 2010 10:43 PM
Subject: [Wireshark-users] Output of 'tshark -T fields' with multipleoccurrences of a field


Hi,

Recently a lot of questions have been asked on this list (and also at Sharkfest) about the output of 'tshark -T fields -e <field>' when <field> had multiple occurrences in one packet. Only the last occurrence was printed by tshark. I submitted a fix that now prints all occurrences, aggregated by commas (which can be overwritten with -E aggregator=<char>).

The fix will be included in version 1.6.x as well as in the next development release (1.5.x). For the impatient, please use an automated build from http://www.wireshark.org/download/automated/ (look for a version 33504 or higher).

Thanks a lot Sake. That is helpfull. I've tested and it works nicely for me.

Unfortunately the latest build keeps crashing the main wireshark tool.

Dave