Wireshark-bugs: [Wireshark-bugs] [Bug 5968] New: tcp values are not printed in tshark with -T fi
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 28 May 2011 02:51:31 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5968

           Summary: tcp values are not printed in tshark with -T fields or
                    -o column.format
           Product: Wireshark
           Version: 1.4.4
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: TShark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: ml@xxxxxxxxxx


Build Information:
TShark 1.4.4

Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.28.0, with libpcap 1.1.1, with libz 1.2.5, with
POSIX capabilities (Linux), without libpcre, with SMI 0.4.8, with c-ares 1.7.4,
with Lua 5.1, without Python, with GnuTLS 2.8.6, with Gcrypt 1.4.6, with MIT
Kerberos, with GeoIP.

Running on Linux 2.6.37.6-0.5-default, with libpcap version 1.1.1, with libz
1.2.5.

Built using gcc 4.5.1 20101208 [gcc-4_5-branch revision 167585].

--
When running the following command:
> tshark -r test.pcap -T fields -E separator=';' -e frame.number -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e tcp.len | head -5

This output is obtained, notice the double ";;" and the lack of last populated
field:
1;May 18, 2011 11:40:58.754078000;10.3.48.10;;172.20.65.4;;
2;May 18, 2011 11:40:58.757426000;172.20.65.4;;10.3.48.10;;
3;May 18, 2011 11:40:58.770216000;10.45.84.164;;10.45.112.4;;
4;May 18, 2011 11:40:58.770496000;10.45.112.4;;10.45.84.164;;
5;May 18, 2011 11:40:58.880415000;10.45.112.4;;10.45.48.12;;

Similar output is obtained with the column.format argument:
> tshark -r test.pcap  -R "sip" -t a   -o 'column.format: "IP src ip", %Cus:ip.src, "IP src port", %Cus:tcp.srcport, "IP dst ip", %Cus:ip.dst, "IP dst port", %Cus:tcp.dstport'  | head -5
10.3.48.10  172.20.65.4 
172.20.65.4  10.3.48.10 
10.45.84.164  10.45.112.4 
10.45.112.4  10.45.84.164 
10.45.112.4  10.45.48.12 

It is expected that the tcp port values are shown here.

Articles on the internet show that such queries should be possible, e.g.:
http://www.clshack.it/en/tshark-command-line-of-wireshark.html
http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/
and more

Can this be fixed, please?

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.