Wireshark-users: [Wireshark-users] absolute frame number in capture with -R ?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Mathias Koerber <mathias@xxxxxxxxxxx>
Date: Mon, 28 Apr 2014 13:29:05 +0800
I have a rather large pcap file I am trying to extract
relevant frames from using tshark.

using

# tshark -2 -n -r infile -R '(filter)' -T fields -e frame.number

yields frame-numbers starting from 1 anr continuously increasing.
So apparently this counts the frames that matched the display filter.

I would like to print the actual frame-number from the input file,
so that I can later find the frames in their original context.

How to do that?