Re: How to re-assemble contents of a USB upload?

[Chris Maynard <Chris.Maynard () gtech com>]

Svenn Are Bjerkem <svenn.bjerkem@...> writes:

> On 28 June 2011 22:33, Chris Maynard <Chris.Maynard@...> wrote:
> > tshark -r yourusbcapturefile.pcap -R "usb.transfer_type == 3 &&
> > usb.endpoint_number.direction == 0 && usb.device_address == 0x40" -T 
fields -e
> > usb.capdata
>
> $> tshark -v
> TShark 1.4.6
>
> I got an error message that usb.endpoint_number.direction == 0 is not
> supported, ...

OK, well I was either using 1.6.0 or the latest version of tshark from the 
trunk, I don't remember which, so obviously that display filter was added post 
1.4.6.

> Thanks a lot, and cheers

You're welcome.  Glad it helped.


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe