Wireshark · Wireshark-users: [Wireshark-users] OSPF LS Aging Field - Output Question

["Barry Constantine" <Barry.Constantine@xxxxxxxx>]

Hello,

 

I am trying to us the  “–T fields –e” options to get the LS Age field out of OSPF LS Update packets (and dump to text file).

 

The problem I am running into is that the LS Age field display filter is only an offset into the frame (i.e. frame[62:2] in this case).

 

When I use this command:

 

tshark -r ospf-pcap.pcap -T fields -e frame.number -e frame.time –e frame[62:2] -R "(ospf.msg == 4) "

 

I get the LS Update packets, frame number, and frame time; but not the LS Age Field (frame[62:2].

 

Any help would be greatly appreciated.

 

Thanks,

Barry