On Mon, Apr 28, 2014 at 1:29 AM, Mathias Koerber <mathias@xxxxxxxxxxx> wrote:
>
> I have a rather large pcap file I am trying to extract
> relevant frames from using tshark.
>
> using
>
> # tshark -2 -n -r infile -R '(filter)' -T fields -e frame.number
>
> yields frame-numbers starting from 1 anr continuously increasing.
> So apparently this counts the frames that matched the display filter.
>
> I would like to print the actual frame-number from the input file,
> so that I can later find the frames in their original context.
>
> How to do that?
If you're using tshark 1.10 or later, use the -Y 'filter' flag instead
of -R 'filter'.
Evan
