Re: Get expert info from tshark

[Pascal Quantin <pascal.quantin () gmail com>]

Hi Zhao,

2017-10-12 2:28 GMT+02:00 Zhao Lin <zlbinghamton () gmail com>:

> Hi,
>
> I have been trying to get expert info on tshark but with no much luck. The
> command that I use is
>
> tshark -r file.pcap -z expert,warn -q
>
> While this command does provide me the summary of warnings, but I also
> want to know the packet number(s) associated with each warning/error as in
> the GUI. Is this doable?

You can give a try to the following command line and adapt it per your
needs:

tshark -r file.pcap -Y '_ws.expert.severity == "Warning"' -T fields -e
frame.number -e _ws.expert

Best regards,
Pascal

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe