Wireshark · Wireshark-users: Re: [Wireshark-users] Accessing the NT ACE Information field from TShark in SMB NT Trans Request, NT

["j.snelders" <j.snelders@xxxxxxxxxx>]

Hi Guy,

Print all and send the output to a csv file:
$ tshark -r local_permissions_changes.pcap -R "smb.cmd == 0xa0" -T fields
-e frame.number -e nt.sid -E separator=, > local_permissions_changes.csv


Use occurrence=f|l|a to print the first, last or all occurences of each field.


To print the first occurence:
$ tshark -r local_permissions_changes.pcap -R "smb.cmd == 0xa0" -T fields
-e frame.number -e nt.sid -E occurrence=f -E separator=, > local_permissions_changes2.csv

More information:
tshark -h
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as aggregator
     quote=d|s|n           select double, single, no quotes for values

Hope this helps
Joke

On Sun, 3 Oct 2010 17:44:39 +0200 Guy other wrote:
>
>Hi,
>When I capture using TShark, I would like to use the "-T fields -e
><fieldname>" flag to get the different NT ACE fields in a
>SMB NT Trans Request, NT SET SECURITY packet.
>
>The thing is that there can be a different number of NT ACE fields in the
>packet.
>Is there some syntax to specify which one I want to access? can I somehow
>iterate over all of the ACE fields?
>
>In Wireshark you can see the different fields, My question is how to do
it
>from the command line with TShark.
>I'm attaching an example .pcap file, the request is in packet 1824
>Thanks!