Wireshark · Wireshark-dev: Re: [Wireshark-dev] tshark -T fields

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Peter Gordon wrote:
> tshark can be used to display fields using the -T option.
> If the same field occurs a number of times within a protocol,
> only one value ( the last ) gets displayed.
>
> As far as I can see the error looks like it comes from the 
> routine proto_tree_write_fields. 
>
> The -T pdml option gives the correct output, but is too voluminous.
>
> Can anyone help with a fix?

There's at least one bug for that:

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3818

It was discussed quite a bit at Sharkfest this year too--there seemed to 
be quite a bit of interest in finding a way to fix it.  (But: as 
evidenced by the fact that there is so much interest and it hasn't been 
done yet, it's non-trivial to implement.)