Wireshark · Wireshark-dev: [Wireshark-dev] Extracting expert info using tshark

Wireshark-dev: [Wireshark-dev] Extracting expert info using tshark

From: Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx>

Date: Wed, 14 Sep 2011 11:17:09 +0100

Hi,

I'd like to be able to extract the information that Wireshark shows in the 'Expert Info Composite' window using tshark, i.e. list each category (error, warning, note, chat) as a separate section - not sure if I'd want to sort them within the section or just leave it chronological...

It doesn't look like it would be straightforward to script this... would adding an option such as -z expert_info,stat be the best way to implement this?

Thanks,
Martin

Follow-Ups:
- Re: [Wireshark-dev] Extracting expert info using tshark
  - From: Martin Mathieson

Prev by Date: [Wireshark-dev] For TShark, provide a way to control the output format. E.g., 'tshark -e "ip udp tcp.port"' would expand the IP and UDP sections, and display the TCP port information.
Next by Date: Re: [Wireshark-dev] WAPI decode and decryption
Previous by thread: Re: [Wireshark-dev] For TShark, provide a way to control the output format. E.g., 'tshark -e "ip udp tcp.port"' would expand the IP and UDP sections, and display the TCP port information.
Next by thread: Re: [Wireshark-dev] Extracting expert info using tshark
Index(es):
- Date
- Thread