Wireshark-users: Re: [Wireshark-users] decode from a specific frame
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Apr 2008 18:15:10 -0700
John huysing wrote:
If I have a capture file and I know the frame number(s) of the packet I want to inspect.
I want to get a detailed packet decode of that/those packet(s). Can i do this with tshark. 

	tshark -V -r {capture file} -R "frame.number == {frame number}"
will print out the frame in question. You can do "frame.number == {first frame number} or frame.number == {second frame number} or ..." if you want multiple frames.