Wireshark-users: Re: [Wireshark-users] Is there a way to get the Tshark command to print the appl
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 20 Mar 2008 18:51:03 -0700

On Mar 20, 2008, at 11:59 AM, DFE (Donald Ernst) wrote:
I am trying to use WireShark to measure the response time of my server for certain applications and need to use it without its GUI. Right now, I execute "Tshark -a duration:120 -i 2 >> test.txt" to collect the data. This gives me a nice readable text file I can process with my own program. However, this method does not give me the application data, just summary information for each packet. Is there any way to get the actual application data using the Tshark command?
What do you mean by "the actual application data"? If you use the "- V" flag, TShark will give a full dissection of the packet (the equivalent of what would appear in the packet detail pain for Wireshark).