Wireshark mailing list archives

absolute frame number in capture with -R ?


From: Mathias Koerber <mathias () koerber org>
Date: Mon, 28 Apr 2014 13:29:05 +0800


I have a rather large pcap file I am trying to extract
relevant frames from using tshark.

using

# tshark -2 -n -r infile -R '(filter)' -T fields -e frame.number

yields frame-numbers starting from 1 anr continuously increasing.
So apparently this counts the frames that matched the display filter.

I would like to print the actual frame-number from the input file,
so that I can later find the frames in their original context.

How to do that?

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe


Current thread: