Wireshark · Wireshark-users: Re: [Wireshark-users] Tshark - displaying all sdp.media_attr on win2k system

[Christopher Maynard <Chris.Maynard@xxxxxxxxx>]

Christopher Maynard <Chris.Maynard@...> writes:

> > > Any thoughts? Or am I out of luck?
> > 
> > You might be able to use something like: tshark -R "frame contains FOO"
> > or even: tshark -R "sdp.media_attr && frame contains FOO"
> 
> Of course that will only help you find the packets that contain what you're
> looking for, but it won't print the fields, so you could also try using "-V" to
> print out all the packet details, redirect the output to a file, then grep for
> your matching "Media Attribute" lines that way?

Another possible alternative - use the latest tshark that supports "-E
occurrence=a", but run it on another host doing remote packet capture?

http://www.winpcap.org/docs/docs_412/html/group__remote.html
http://wiki.wireshark.org/CaptureSetup#Step_5:_Capture_traffic_using_a_remote_machine