Wireshark-bugs: [Wireshark-bugs] [Bug 10573] New: Allow to add custom fields based on filters ex
Date: Thu, 16 Oct 2014 06:57:41 +0000
Bug ID 10573
Summary Allow to add custom fields based on filters expressions
Product Wireshark
Version unspecified
Hardware x86
OS All
Status UNCONFIRMED
Severity Enhancement
Priority Low
Component TShark
Assignee bugzilla-admin@wireshark.org
Reporter javibarroso@gmail.com

Build Information:
$ tshark -v
TShark 1.12.1 (Git Rev Unknown from unknown)

Copyright 1998-2014 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.40.0, with libpcap, with libz 1.2.8, with POSIX
capabilities (Linux), with libnl 3, with SMI 0.4.8, with c-ares 1.10.0, with
Lua
5.2, without Python, with GnuTLS 3.3.7, with Gcrypt 1.6.2, with MIT Kerberos,
with GeoIP.

Running on Linux 3.16-2-amd64, with locale es_ES.UTF-8, with libpcap version
1.6.2, with libz 1.2.8.
       Intel(R) Core(TM) i3-3110M CPU @ 2.40GHz

Built using gcc 4.9.1.

--
Hello,

I would like to distinguish frames from the tshark output, see this failed
attemp :

tshark -r mydump-20141015-185000.dump  -Y "frame contains a or frame contains
b" -T fields -e frame.time -e "frame contains a" -e "frame contains b"

I would like next output:

time1 0 1 # not comtains a and contains b
time2 1 1 # contains a and contains b
time3 1 0 # contains a and not contains b

Thank you very much !
PD: From
https://ask.wireshark.org/questions/37082/tshark-using-filter-_expression_-as-field
I was asked to open a new enhancemment bug.


You are receiving this mail because:
  • You are watching all bug changes.