aboutsummaryrefslogtreecommitdiffstats
path: root/doc/tshark.pod
AgeCommit message (Collapse)AuthorFilesLines
2013-04-19Add col. pseudo dissector to thsark manpage.Jörg Mayer1-2/+2
svn path=/trunk/; revision=48931
2013-04-05Coalesce "-G fields2" and "-G fields3" into "-G fields", as discussed on -dev.Chris Maynard1-15/+7
See: http://www.wireshark.org/lists/wireshark-dev/201304/msg00015.html svn path=/trunk/; revision=48753
2013-03-30Update -2, -R and -Y to behave consistently as per the concensus reached onEvan Huus1-15/+17
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223 Mention the new -Y flag and associated changes in the release notes. svn path=/trunk/; revision=48654
2013-03-27From Hadriel Kaplan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223Evan Huus1-2/+23
Add a 2-pass display-filter flag to tshark so that reassembly and other forward- looking dissections can be used with filters. It's a bit of a hack, but this entire area of 2-pass analysis etc. is a giant pile of hacks to begin with and needs cleaning up. For now just having this feature is a big enough win. svn path=/trunk/; revision=48589
2013-03-21Updated tshark man page and release notes to document the change in '-x' ↵Chris Maynard1-5/+4
behavior with r45715. svn path=/trunk/; revision=48456
2013-03-11Document the wmem override environment variable in the man pages, and improveEvan Huus1-0/+8
README.wmem in a couple of places. svn path=/trunk/; revision=48251
2013-03-11Followup to r48218: remove documentation of the WIRESHARK_DEBUG_USE_SLICES ↵Jeff Morriss1-6/+0
environment variable. svn path=/trunk/; revision=48249
2013-02-28Default capture buffer size is now 2MB.Jeff Morriss1-2/+2
svn path=/trunk/; revision=47937
2013-02-20From Edwin Groothuis via ↵Chris Maynard1-0/+26
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8353 : Document http-related '-z' statistics; also add document -z help. From me: Don't print an error message for "-z help". (Only "http,stat," is suitable for backport to 1.8 and 1.6) svn path=/trunk/; revision=47763
2013-01-30Add support in TShark to follow SSL streams Michael Mann1-0/+1
From QA Cafe, bug 8280 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8280) svn path=/trunk/; revision=47372
2013-01-16As suggested in comments in sl_alloc() and sl_free(): add a new environmentJeff Morriss1-0/+6
variable (WIRESHARK_DEBUG_USE_SLICES) which turns off the slab allocator and uses g_slices instead (which can themselves be turned off by setting G_SLICE=always-malloc). This makes debugging problems in slab-allocated memory easier to find (hopefully including https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8197 ). Set WIRESHARK_DEBUG_USE_SLICES when running Valgrind on *shark. Remove unused structure member: emem_chunk_t.org. svn path=/trunk/; revision=47110
2012-12-20Add -Q option to TShark to force only "true" errors to stderr. No "status" ↵Michael Mann1-0/+7
messages should be included if -Q option is specified. Bug 2881 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2881) svn path=/trunk/; revision=46627
2012-12-12Document the "-g" option to dumpcap.Jeff Morriss1-0/+7
Add that option to tshark, too, and document it. The option can't be given to Wireshark because the GUI already has a "-g" (goto packet). svn path=/trunk/; revision=46513
2012-11-29Add an add_hosts_file routine that adds a "hosts" path to an array andGerald Combs1-1/+1
use it in tshark.c instead of read_hosts_file. This lets us use "-H" multiple times. Make read_hosts_file static. svn path=/trunk/; revision=46273
2012-10-24List -z compare,... in the statistics documentation. Maybe someone who ↵Chris Maynard1-1/+6
actually knows how to use it could elaborate? svn path=/trunk/; revision=45769
2012-10-23Inspired by ↵Chris Maynard1-0/+6
http://www.wireshark.org/lists/wireshark-users/201206/msg00025.html, add support for being able to specify a numeric range as the <selector> part of tshark's -d <layer type>==<selector>,<decode-as protocol> option. svn path=/trunk/; revision=45734
2012-07-08First phase of fixing https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7380 :Jeff Morriss1-0/+3
Add a new name resolution option: whether or not use the configured (in the OS) name resolver (e.g., DNS) to resolve network names. When this option is disabled but network name resolution is enabled then Wireshark will resolve only those names that it can from local sources. This includes (at least, AFAIK): - name resolutions that Wireshark picks up on from DNS packets it decodes - the "user hosts file" (~/.wireshark/hosts on *NIX) - what Wireshark reads out of capture file (the PCAPNG name resolution block) This new preference defaults to "use external resolvers" for backward compatibility (so people turning on network name resolution will get the old behavior). This option can be set via Edit->Preferences and on the command line; there remain several UIs (e.g., the "open capture file" dialog, the View->Name Resolution menu, etc.) that don't have the new option yet. Also expand on the "description" for the name resolution preferences: these are used not only in the tooltips but are also written to the preferences file. The previous text didn't include enough context when written do the preferences file. svn path=/trunk/; revision=43605
2012-06-19Remove what appears to be an errant vi/vim command and add a newline.Gerald Combs1-1/+1
svn path=/trunk/; revision=43371
2012-03-19Fix a typo or twoJeff Morriss1-2/+2
svn path=/trunk/; revision=41657
2012-03-19Add a new environment variable (WIRESHARK_ABORT_ON_OUT_OF_MEMORY) thatJeff Morriss1-3/+10
prevents OutOfMemory exceptions from being thrown. This makes it easier to debug such conditions. Set this variable in test-fuzzed-cap.sh but not in fuzz-test.sh; it's nice to see the friendly out-of-memory error message in the bug reports the latter script generates. svn path=/trunk/; revision=41656
2012-03-15Sort the -z options.Chris Maynard1-250/+250
svn path=/trunk/; revision=41560
2012-02-27Add documentation for the the tshark follow tcp/udp streams feature addedJeff Morriss1-3/+58
with https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6684 svn path=/trunk/; revision=41212
2012-02-07Update the documentation to match the sort order. This documentation error ↵Chris Maynard1-1/+1
was pointed out by Markus Amend on -users. Reference: http://article.gmane.org/gmane.network.wireshark.user/14477 (BTW, I quickly scanned through tap-iousers.c:iousers_draw() and the sorting seems to be very inefficient.) svn path=/trunk/; revision=40911
2012-02-03The libpcap puts pcap-filter into the misc section (which seems to be 7).Jörg Mayer1-3/+3
Refer to pcap-filter and mention tcpdump only as a fallback. svn path=/trunk/; revision=40820
2011-11-30Add missing comments in syntax description for -z expertMartin Mathieson1-1/+1
svn path=/trunk/; revision=40050
2011-11-30Change the -z args for expert item. You can now give the minimum severity ↵Martin Mathieson1-6/+7
level to report as well as a filter. Also, now show duplicate reports only once, and give the frequency rather than the frame number. svn path=/trunk/; revision=40049
2011-11-08From Michael Mann via ↵Chris Maynard1-3/+3
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6377, with the tshark man page update by me: tshark -z io,stat,interval,"[SUM|MIN|MAX|AVG](field)field [and filter]" should support floating point. svn path=/trunk/; revision=39767
2011-09-28Rather than complain and quit if -V is missing when -O <protocols> is used, ↵Chris Maynard1-4/+11
do the user a favor and continue as if -V had been specified. Add explicit documentation of the -O <protocols> option to the man page. svn path=/trunk/; revision=39175
2011-09-27Add a new tshark option for being able to specify an alternate line ↵Chris Maynard1-10/+20
separator between packets. The option chosen was "-S <separator>". The former -S option was renamed to -P, and the former -P option, which was previously undocumented, was renamed to -2. This fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5342. svn path=/trunk/; revision=39168
2011-09-23Fix a couple of typos and use 2 spaces consistently after a period.Chris Maynard1-65/+65
svn path=/trunk/; revision=39092
2011-09-23Trivial: Add missing <interval> in one case of tshark -z io,stat usage.Chris Maynard1-1/+1
svn path=/trunk/; revision=39091
2011-09-15Add a tap for showing all expert items.Martin Mathieson1-0/+15
svn path=/trunk/; revision=39010
2011-09-15Alphabetical order, please.Guy Harris1-1/+1
svn path=/trunk/; revision=39009
2011-07-14Add LTE RLC stats tap to tshark.Martin Mathieson1-1/+16
svn path=/trunk/; revision=38019
2011-07-14Add LTE MAC statistics to tshark.Martin Mathieson1-0/+15
svn path=/trunk/; revision=38016
2011-06-28Document the handling of command line parameters with respect toMichael Tüxen1-0/+44
the capturing on multiple interfaces. svn path=/trunk/; revision=37824
2011-06-07Add description of LOAD stats for tshark to the manpageRonnie Sahlberg1-2/+25
svn path=/trunk/; revision=37587
2011-06-05From Cal Turney:Anders Broman1-27/+89
1.) The resolution of the time values displayed by tshark's "-z io,stat, ..." should be increased from milliseconds to microseconds (from 3 to 6 decimal places) in order to be consistent with -z relative time-related options such as "-z smb,rtt" and "-z rpc,rtt" which display values to 5 decimal places. [Please note that separate enhancement requests for 6 decimal of precision in Wireshark will be submitted shortly.) 2.) The "frames bytes" column displayed in '-z io,stat' is too narrow, frames and bytes should each have 15 spaces like all the other column types. 3.) The types "FRAMES" and "BYTES" should be added to allow users to display these values separately and allow for filters to be specified. 4.) The 'SUM' option should allow for relative time values such as SRTs to be summed. This would be useful for the calculation of such things as request concurrency (total_SRT_time / duration). 5.) The tshark man page needs some corrections and readability improvements https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4915 svn path=/trunk/; revision=37555
2011-04-29From Edwin Groothuis via bug 5870:Stig Bjørlykke1-1/+5
The supplied patch adds a new option -O, which specifies a list of protocols (names can be found with the "-G protocols" option) to be fully decoded while the others only show the layer header. svn path=/trunk/; revision=36947
2011-04-12Fix tshark doc (ip.src==1.2.3.4) is not a valid filter for ICMPv6 trafic ;)Alexis La Goutte1-2/+2
svn path=/trunk/; revision=36582
2011-04-11Add conversation tracking and tshark tap support to ICMPv6. Fixes bug 5810.Chris Maynard1-0/+11
TODO: Add a Wireshark tap or look into possibly using the stats tree instead. Also, like ICMP, the ICMPv6 payload appears to carry the sender's timestamp, so it might be possible to make use of this information to estimate the total SRT. (See bug 5770 for more details.) svn path=/trunk/; revision=36561
2011-04-06Add computation of median and change standard deviation calculation to "sample"Chris Maynard1-1/+2
standard deviation. Split statistics output onto 2 lines. svn path=/trunk/; revision=36501
2011-04-05Add ICMP tap support, and add a tshark tap to measure such things as:Chris Maynard1-0/+10
* Number of ICMP echo requests, replies, lost replies and percent loss. * Min, Max, Average SRT (Service Response Time), and standard deviation. (This is my first tap, so hopefully I didn't miss something, but we'll see ...) TODO: Add a Wireshark tap. svn path=/trunk/; revision=36480
2011-03-27Add "-z hosts", which dumps name resolution information in hosts format.Gerald Combs1-0/+8
svn path=/trunk/; revision=36372
2011-03-24Add initial pcapng name resolution record support. Wireshark has readGerald Combs1-0/+26
support; TShark has read+write support. Additionally TShark can read a "hosts" file and write those records to a capture file. This uses "struct addrinfo" in many places and probably won't compile on some platforms. svn path=/trunk/; revision=36318
2011-03-23From: http://www.wireshark.org/lists/wireshark-dev/201103/msg00157.htmlChris Maynard1-31/+59
Change RTT references to SRT. (tshark.pod could use a description for -z afp,srt and -z camel,srt) svn path=/trunk/; revision=36297
2010-11-27From OKANO Takayoshi via bug #5442: Fix typos in documentationStephen Fisher1-1/+1
svn path=/trunk/; revision=35038
2010-11-09Fixed typos.Chris Maynard1-14/+11
svn path=/trunk/; revision=34815
2010-10-20Add IPFIX_RECORDS_TO_CHECK to the environment variable section.Jeff Morriss1-0/+7
svn path=/trunk/; revision=34590
2010-09-02Introduce 2 new environment variables: WIRESHARK_EP_VERIFY_POINTERS andJeff Morriss1-15/+29
WIRESHARK_SE_VERIFY_POINTERS that control whether or not we verify if a given pointer is ep_ or se_ allocated, respectively. Turn the behavior off by default for speed reasons (the speed difference isn't huge, but...). Turn the behavior on when fuzz testing. Document these two new variables in the man pages. svn path=/trunk/; revision=34046
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-24 00:25:57 +0000