Wireshark · Wireshark-users: Re: [Wireshark-users] tshark jump to frame number

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

Hmm, lets look at the manual page.

-V verbose, oke we take that one.
-R read filter in display filter syntax. Sounds good: frame.number == <n>
-r read capture file. Indeed.

Here we go:

> tshark -V -R frame.number==<n> -r <capturefile>

And there you have it. Frame n in all its glory.

Thanks,
Jaap

On Thu, 25 Feb 2010 05:24:37 -0800, M Holt <m.iostreams@xxxxxxxxx> wrote:
> Hello,
> 
> I would like to know how to use tshark to "jump" to a specific frame
> number.
> In Wireshark, it's ctrl-g, so I am hoping that there is something
> similar in tshark.
> 
> I would like to be able to print a single known packet verbosely,
> meaning all packet information, for one single known packet.
>  I have tried using -T fields -e frame.number == , but that does not
> give the expected results.
> 
> If this is possible, is it also possible to display more than one?  Say
> a list, or a range?
> 
>  Thanks in advance,
> Mike