Re: Various problems with tshark

[Pascal Quantin <pascal.quantin () gmail com>]

Hi Jörg,

2015-08-31 5:34 GMT+02:00 Joerg Mayer <jmayer () loplof de>:

> When using tshark from head I have a bunch of problems right now:
>
> 1) stderr is getting spammed with
> (process:9870): Capture-WARNING **: Dissector stp incomplete in frame
> 41915: undecoded byte number 57 (0x0030+9)

You seem to have activated the prefs.enable_incomplete_dissectors_check.
Simply go to Preferences -> Protocols and uncheck "Look for incomplete
dissectors".


> 2) -T fields -e _ws.col.info isn't working (empty column), both with and
> without -V

The right field name is _ws.col.Info

Cheers,
Pascal.

3) Some of my .vwr captures seem to only decode in tshark (with and without
> -V) but
>    don't decode with -2 or in wireshark (I'll open a proper bug for this
> once I have more
>    info). Btw, how can I convert .vwr files to pcapng? Both Save and Save
> As are greyed out.
>
> Thanks
>    Jörg
> --
> Joerg Mayer                                           <jmayer () loplof de>
> We are stuck with technology when what we really want is just stuff that
> works. Some say that should read Microsoft instead of technology.
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe