Wireshark mailing list archives

Re: Output of 'tshark -T fields' with multiple occurrences of a field


From: Sake Blok <sake () euronet nl>
Date: Mon, 19 Jul 2010 19:02:54 +0200

On 19 jul 2010, at 17:03, Martin Visser wrote:

Not saying that this isn't a good idea (being able to output repeated fields), but I suspect when it gets to stable 
you might get some complaints. If people use "-T fields" like they do a CSV file, they might be expecting a fixed 
number of columns. (Currently whether there are 0, 1 or  more instances, I think there are always the same number of 
commas).

Well, the fields are still separated with tabs (by default), but within a field, multiple occurrences are now separated 
by commas (by default). I added another option to be able to select the value of the first occurrence of the field, the 
last occurrence (as it was before my change) and all occurrences (the new default):

  -T pdml|ps|psml|text|fields
                           format of text output (def: text)
  -e <field>               field to print if -Tfields selected (e.g. tcp.port);
                           this option can be repeated to print multiple fields
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as aggregator
     quote=d|s|n           select double, single, no quotes for values

I think that will give everyone the granularity of control they might need. 

You might want to think about adding this new feature only by adding a new switch (say the -E aggregator switch)

Would showing the value of the last occurrence of the field (-E occurrence=l) be a better default? That way the 
behavior does not change unless you specifically ask for it.

Cheers,


Sake

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: