Wireshark · Wireshark-users: Re: [Wireshark-users] tshark --print-a-specific-field ?

[Stephen Fisher <stephentfisher@xxxxxxxxx>]

On Tue, May 29, 2007 at 05:50:47AM -0400, Douglas F. Calvert wrote:

> Hello is there a way to have tshark print a specific field instead of 
> the terse/verbose decoded output? I would like to be able to do:
> 
> tshark -r file --dfc-grovel-flag wlan.bssid
> 
> And have tshark print out the bssid either next to the source/address 
> or instead of the src/address?

Check out the new -Tfields and -e options in the latest Wireshark 
developer versions (they were added after 0.99.5 was released if I 
remember correctly).  The tshark man page describes them.  You can get 
the latest version (0.99.6 developer) from 
http://download.wireshark.org/download/automated/ or you can wait for 
0.99.6 to be released (no set date yet).


Steve