Wireshark-dev: [Wireshark-dev] tshark -x options
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: kahou lei <kahou82@xxxxxxxxx>
Date: Tue, 13 Mar 2012 14:45:17 -0700
Hi,

I am trying to display the hex value of the packet. Currently I am using "-x" option in tshark and I get this output:

  1 62   0.000000 212.179.66.74 -> 224.0.0.2    HSRP Hello (state Active) 62

0000  01 00 5e 00 00 02 00 00 0c 07 ac 01 08 00 45 c0   ..^...........E.
0010  00 30 00 00 00 00 02 11 c0 fd d4 b3 42 4a e0 00   .0..........BJ..
0020  00 02 07 c1 07 c1 00 1c 81 00 00 00 10 03 0a 69   ...............i
0030  01 00 63 69 73 63 6f 00 00 00 d4 b3 42 46         ..cisco.....BF

But when I use wireshark "Export" function with only packet byte enabled, I don't get the description of the packet. That is, I only get this:

0000  01 00 5e 00 00 02 00 00 0c 07 ac 01 08 00 45 c0   ..^...........E.
0010  00 30 00 00 00 00 02 11 c0 fd d4 b3 42 4a e0 00   .0..........BJ..
0020  00 02 07 c1 07 c1 00 1c 81 00 00 00 10 03 0a 69   ...............i
0030  01 00 63 69 73 63 6f 00 00 00 d4 b3 42 46         ..cisco.....BF

Can anyone tell me if I can achieve the same thing that wireshark does in tshark?

Thanks,
Kahou