diff options
author | Anders Broman <anders.broman@ericsson.com> | 2010-06-18 17:18:00 +0000 |
---|---|---|
committer | Anders Broman <anders.broman@ericsson.com> | 2010-06-18 17:18:00 +0000 |
commit | 4e220d29ff8d81118628de2ed4542f33a228f1fc (patch) | |
tree | 3aa24523a6229451e3ac97812239137037208101 /doc/tshark.pod | |
parent | b0c0ebcc201470cc66e3f485f9e08eda84bb4654 (diff) |
From Jim Young:
The attached patch simply documents a long supported but hidden tshark -G
option.
Tshark's print_usage() has been augmented as well as the tshark man page.
svn path=/trunk/; revision=33253
Diffstat (limited to 'doc/tshark.pod')
-rw-r--r-- | doc/tshark.pod | 92 |
1 files changed, 92 insertions, 0 deletions
diff --git a/doc/tshark.pod b/doc/tshark.pod index 5398fd5bbf..24c7a6e0ba 100644 --- a/doc/tshark.pod +++ b/doc/tshark.pod @@ -43,6 +43,9 @@ S<[ B<-y> E<lt>capture link typeE<gt> ]> S<[ B<-z> E<lt>statisticsE<gt> ]> S<[ E<lt>capture filterE<gt> ]> +B<tshark> +B<-G> [fields|fields2|fields3|protocols|values|decodes|defaultprefs|currentprefs] + =head1 DESCRIPTION B<TShark> is a network protocol analyzer. It lets you capture packet @@ -126,6 +129,9 @@ arguments, it's a capture filter if a capture is being done (i.e., if no B<-r> option was specified) and a read filter if a capture file is being read (i.e., if a B<-r> option was specified). +The B<-G> option is a special mode that simply causes B<Tshark> +to dump one of several types of internal glossaries and then exit. + =head1 OPTIONS =over 4 @@ -292,6 +298,92 @@ option. The output written with the B<-w> option is raw packet data, not text, so there is no B<-F> option to request text output. The option B<-F> without a value will list the available formats. +=item -G [fields|fields2|fields3|protocols|values|decodes|defaultprefs|currentprefs] + +The B<-G> option will cause B<Tshark> to dump one of several types of glossaries +and then exit. If no specfic glossary type if specified then the B<fields> report +will be generated by default. + +The available report types include: + +B<fields> Dumps the contents of the registration database to +stdout. An independent program can take this output and format it into nice +tables or HTML or whatever. There is one record per line. Each record is +either a protocol or a header field, differentiated by the first field. +The fields are tab-delimited. + + * Protocols + * --------- + * Field 1 = 'P' + * Field 2 = descriptive protocol name + * Field 3 = protocol abbreviation + * + * Header Fields + * ------------- + * Field 1 = 'F' + * Field 2 = descriptive field name + * Field 3 = field abbreviation + * Field 4 = type ( textual representation of the the ftenum type ) + * Field 5 = parent protocol abbreviation + * Field 6 = blurb describing field + +B<fields2> Same as the B<fields> report but includes two additional columns. + + * Field 7 = base for display (for integer types); "parent bitfield width" for FT_BOOLEAN + * Field 8 = blurb describing field (yes, apparently we repeated this accidentally) + +B<fields3> Same as the B<fields> report but includes two additional columns. + + * Field 7 = base for display (for integer types); "parent bitfield width" for FT_BOOLEAN + * Field 8 = bitmask: format: hex: 0x.... + +B<protocols> Dumps the protocols in the registration database to stdout. +An independent program can take this output and format it into nice tables +or HTML or whatever. There is one record per line. The fields are tab-delimited. + + * Field 1 = protocol name + * Field 2 = protocol short name + * Field 3 = protocol filter name + +B<values> Dumps the value_strings, range_strings or true/false strings +for fields that have them. There is one record per line. Fields are +tab-delimited. There are three types of records: Value String, Range +String and True/False String. The first field, 'V', 'R' or 'T', indicates +the type of record. + + * Value Strings + * ------------- + * Field 1 = 'V' + * Field 2 = field abbreviation to which this value string corresponds + * Field 3 = Integer value + * Field 4 = String + * + * Range Strings + * ------------- + * Field 1 = 'R' + * Field 2 = field abbreviation to which this range string corresponds + * Field 3 = Integer value: lower bound + * Field 4 = Integer value: upper bound + * Field 5 = String + * + * True/False Strings + * ------------------ + * Field 1 = 'T' + * Field 2 = field abbreviation to which this true/false string corresponds + * Field 3 = True String + * Field 4 = False String + +B<decodes> Dumps the "layer type"/"decode as" associations to stdout. +There is one record per line. The fields are tab-delimited. + + * Field 1 = layer type, e.g. "tcp.port" + * Field 2 = selector in decimal + * Field 3 = "decode as" name, e.g. "http" + +B<defaultprefs> Dumps a default preferences file to stdout. + +B<currentprefs> Dumps a copy of the current preferences file to stdout. + =item -h Print the version and options and exits. |