0

Is it possible to view detailed info like for example tshark -i eth0 -f "dst port 53" -n -V shows for certain field only? I tried with for example tshark -i eth0 -f "dst port 53" -n -T fields -e dns.opt -V, but this does not work. If I remove the -V and execute tshark -i eth0 -f "dst port 53" -n -T fields -e dns.opt, then 1\n is printed if the dns.opt field is present and \n is printed if this field does not exists. However, I would like to have an output similar to this:

# tshark -i eth0 -f 'host 216.239.32.10' -T fields -e dns.opt -V
Running as user "root" and group "root". This could be dangerous.
Capturing on 'eth0'
Frame 1: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
            Option: CSUBNET - Client subnet
                Option Code: CSUBNET - Client subnet (8)
                Option Length: 7
                Option Data: 00011818a5e311
                Family: IPv4 (1)
                Source Netmask: 24
                Scope Netmask: 24
                Client Subnet: 165.227.17.0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.