Wireshark-users: [Wireshark-users] mount exports
From: Peter Gordon <peter@xxxxxxxxxxxxxxxxxx>
Date: Sun, 27 Jun 2010 12:31:17 +0300
I am trying to use tshark to dump some of the contents of a frame. In
particular, I issued an rpc call to EXPORT. I get a reply with a
hierachy:

Mount Service
  Export List Entry
    Directory 
     contents

This grouping recurs a number of times in the frame. I want to know how
to dump _every_ occurrence of the contents field in the frame.

I have tried 
tshark -n -r a.cap -T fields  -e  mount.export.directory 
but it just prints one entry per frame, not all of them.

Thanks,

Peter