Wireshark-users: Re: [Wireshark-users] How to re-assemble contents of a USB upload?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Chris Maynard <Chris.Maynard@xxxxxxxxx>
Date: Tue, 28 Jun 2011 23:23:21 +0000 (UTC)
Svenn Are Bjerkem <svenn.bjerkem@...> writes:

> On 28 June 2011 22:33, Chris Maynard <Chris.Maynard@...> wrote:
> > tshark -r yourusbcapturefile.pcap -R "usb.transfer_type == 3 &&
> > usb.endpoint_number.direction == 0 && usb.device_address == 0x40" -T 
fields -e
> > usb.capdata
> 
> $> tshark -v
> TShark 1.4.6
> 
> I got an error message that usb.endpoint_number.direction == 0 is not
> supported, ...

OK, well I was either using 1.6.0 or the latest version of tshark from the 
trunk, I don't remember which, so obviously that display filter was added post 
1.4.6.

> Thanks a lot, and cheers

You're welcome.  Glad it helped.