Wireshark-users: Re: [Wireshark-users] how to print time with epoch formation by tshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Jul 2008 14:45:08 -0700

On Jul 9, 2008, at 5:17 PM, Guy Harris wrote:


With the 1.0.1 or current SVN version of Wireshark, you can, on UN*X,
do something such as

	tshark -t e -o 'column.format:"Time", "%t", "XXXXXX", "%Cus:XXXXXX"'


Or you could just do

	tshark -t e -o "column.format:Time,%t,XXXXXX,%Cus:XXXXXX"

without any spaces or embedded quotes, which...


On Windows, I leave it as an exercise to the reader to figure out
whether it's possible, with the cmd.exe command interpreter, to pass
to a command a single argument that

	1) includes spaces

and

	2) includes a bunch of double-quoted strings.
...should work on Windows. Just don't put any spaces in the column heading for the XXXXXX field.