aboutsummaryrefslogtreecommitdiffstats
path: root/doc/tshark.pod
AgeCommit message (Collapse)AuthorFilesLines
2014-06-25Indicate tshark can read (-r) from stdin and named pipes now.Jeff Morriss1-2/+3
(Though it works only with certain formats.) As requested in: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2874#c4 Change-Id: I2ce0509d8750b21ae0167d12459074ba0f9506f8 Reviewed-on: https://code.wireshark.org/review/2646 Reviewed-by: Evan Huus <eapache@gmail.com>
2014-06-16More Python-bindings removal.Jeff Morriss1-6/+0
Change-Id: I4d82175781e65c73179f4c8e737a7900cb050bce Reviewed-on: https://code.wireshark.org/review/2283 Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
2014-03-19Add read_format extension to manual pagesHadriel Kaplan1-2/+6
The -X read_format extension was added in code but in the manuals. Change-Id: I21692120229ef531671fc3db247809ace69d23b3 Reviewed-on: https://code.wireshark.org/review/742 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2014-02-13Lua: add ability for scripts loaded from command-line to be passed argumentsHadriel Kaplan1-0/+7
This change adds the ability to pass on to lua scripts loaded from the command-line (tshark or wireshark) additional arguments supplied by the command-line. This will help us in our testsuites, but also might be useful for user-created scripts. The additional arguments are passed in using the '-X' eXtension switch. Change-Id: Ib94cdf1ffd194ca84692fee7816665e4ff95efbd Reviewed-on: https://code.wireshark.org/review/156 Reviewed-by: Evan Huus <eapache@gmail.com> Tested-by: Evan Huus <eapache@gmail.com>
2013-12-23From Ville Skyttä: Spelling FixesBill Meier1-1/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9591 svn path=/trunk/; revision=54387
2013-12-11Improve tshark command-line error help. Fixes ↵Chris Maynard1-13/+21
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9548 and adds addtional help, better formatting, sorting and some minimal documentation of the -u option to the tshark man page. svn path=/trunk/; revision=53938
2013-12-02Specify SI units for the max filesize autostop condition. For now, keep the ↵Chris Maynard1-7/+7
capture buffer size in IEC units, but document it as such. #BACKPORT(1.10, 1.8(?)) svn path=/trunk/; revision=53728
2013-11-06Add support for displaying dates as year and day-of-year (1-origin).Guy Harris1-10/+19
In the process, fix various man page descriptions of the -t flag, and add support for UTC absolute times in the iousers and iostat TShark taps. svn path=/trunk/; revision=53114
2013-10-15From Ed Beroset via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9272Chris Maynard1-13/+40
Add tshark -G column-formats report and document the missing ftypes, heuristic-decodes and plugins reports. From me: Sort the reports. Add modelines to epan/column.c. Minor whitespace changes. svn path=/trunk/; revision=52627
2013-10-09Make column "filter name" prefixed with _ws. to be the same as other "*shark ↵Michael Mann1-2/+2
application filters" created in r52462. svn path=/trunk/; revision=52474
2013-09-13Add WIRESHARK_APPDATA description to the rawshark and tshark man pages.Jeff Morriss1-0/+6
svn path=/trunk/; revision=52024
2013-08-29Handle the 2GiB boundary case of the max filesize autostop condition ↵Chris Maynard1-7/+7
properly so that we avoid overflow conditions and so that we ensure we don't capture more than 2GiB. Also, document the max filesize autostop value of 2GIB as well as indicating that it's truly GiB and not GB. This fixes the problem reported on ask: http://ask.wireshark.org/questions/23891/wireshark-wont-run-with-multiple-capture-files #BACKPORT(1.10) ... not sure about 1.8? svn path=/trunk/; revision=51576
2013-08-09Move the description of the -Y <displaY filter> option to maintain a proper ↵Chris Maynard1-15/+15
sort. svn path=/trunk/; revision=51238
2013-08-01add --capture-comment to tshark's manpageMartin Kaiser1-0/+8
fix a typo in the dumpcap manpage svn path=/trunk/; revision=51096
2013-07-28If a core Wireshark developer repeatedly can't remember that theGuy Harris1-5/+5
argument to the -F flag for pcap format is "libpcap", not "pcap", we have a problem. Make it "pcap", and add a backwards-compatibility hack to support using "libpcap" as well. Update the man pages to refer to it as pcap as well, and fix the capitalization of "WinPcap" (see http://www.winpcap.org) while we're at it. Also, refer to http://www.tcpdump.org/linktypes.html for the list of link-layer header types for pcap and pcap-ng. svn path=/trunk/; revision=50989
2013-07-08From Jim Young via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8906 :Jeff Morriss1-7/+13
This patch augments Wireshark's and tshark's augument usage reports (-? and -t?) and the Wireshark and tshark man pages to list all available timestamp options available for the -t option. svn path=/trunk/; revision=50445
2013-06-05Add a new environment variable to cause abort()s if we add too many itemsJeff Morriss1-0/+12
to the tree (to separate this case from the generic DISSECTOR_BUG case). Enable this environment variable when fuzz testing. Enable the 3rd (without tree but with a read filter) check (added in r49643) when testing capture files but not when fuzz testing--not sure if we want to add even more to the fuzzbot's work load now (OTOH I've been running it for a while and it hasn't buried me in bugs). svn path=/trunk/; revision=49784
2013-05-20If tcpdump doesn't exist, why refer to it? Omit this confusing phrase.Chris Maynard1-1/+1
svn path=/trunk/; revision=49427
2013-05-19At the suggestion of Stuart Kendrick via ↵Evan Huus1-9/+9
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8647 Improve documentation for tshark's -z io,stat somewhat so that it's clear(er) that filters for the statistics must be associated with the -z flag and not applied via -Y. svn path=/trunk/; revision=49422
2013-05-03From Niels de Vos via ↵Jeff Morriss1-2/+4
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8626 : It is useful to see not only the minimal, maximum and average service time for RPC procedures, but also the total time these took. From me: add it to the man page. svn path=/trunk/; revision=49144
2013-04-19Add col. pseudo dissector to thsark manpage.Jörg Mayer1-2/+2
svn path=/trunk/; revision=48931
2013-04-05Coalesce "-G fields2" and "-G fields3" into "-G fields", as discussed on -dev.Chris Maynard1-15/+7
See: http://www.wireshark.org/lists/wireshark-dev/201304/msg00015.html svn path=/trunk/; revision=48753
2013-03-30Update -2, -R and -Y to behave consistently as per the concensus reached onEvan Huus1-15/+17
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223 Mention the new -Y flag and associated changes in the release notes. svn path=/trunk/; revision=48654
2013-03-27From Hadriel Kaplan via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8223Evan Huus1-2/+23
Add a 2-pass display-filter flag to tshark so that reassembly and other forward- looking dissections can be used with filters. It's a bit of a hack, but this entire area of 2-pass analysis etc. is a giant pile of hacks to begin with and needs cleaning up. For now just having this feature is a big enough win. svn path=/trunk/; revision=48589
2013-03-21Updated tshark man page and release notes to document the change in '-x' ↵Chris Maynard1-5/+4
behavior with r45715. svn path=/trunk/; revision=48456
2013-03-11Document the wmem override environment variable in the man pages, and improveEvan Huus1-0/+8
README.wmem in a couple of places. svn path=/trunk/; revision=48251
2013-03-11Followup to r48218: remove documentation of the WIRESHARK_DEBUG_USE_SLICES ↵Jeff Morriss1-6/+0
environment variable. svn path=/trunk/; revision=48249
2013-02-28Default capture buffer size is now 2MB.Jeff Morriss1-2/+2
svn path=/trunk/; revision=47937
2013-02-20From Edwin Groothuis via ↵Chris Maynard1-0/+26
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8353 : Document http-related '-z' statistics; also add document -z help. From me: Don't print an error message for "-z help". (Only "http,stat," is suitable for backport to 1.8 and 1.6) svn path=/trunk/; revision=47763
2013-01-30Add support in TShark to follow SSL streams Michael Mann1-0/+1
From QA Cafe, bug 8280 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8280) svn path=/trunk/; revision=47372
2013-01-16As suggested in comments in sl_alloc() and sl_free(): add a new environmentJeff Morriss1-0/+6
variable (WIRESHARK_DEBUG_USE_SLICES) which turns off the slab allocator and uses g_slices instead (which can themselves be turned off by setting G_SLICE=always-malloc). This makes debugging problems in slab-allocated memory easier to find (hopefully including https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8197 ). Set WIRESHARK_DEBUG_USE_SLICES when running Valgrind on *shark. Remove unused structure member: emem_chunk_t.org. svn path=/trunk/; revision=47110
2012-12-20Add -Q option to TShark to force only "true" errors to stderr. No "status" ↵Michael Mann1-0/+7
messages should be included if -Q option is specified. Bug 2881 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2881) svn path=/trunk/; revision=46627
2012-12-12Document the "-g" option to dumpcap.Jeff Morriss1-0/+7
Add that option to tshark, too, and document it. The option can't be given to Wireshark because the GUI already has a "-g" (goto packet). svn path=/trunk/; revision=46513
2012-11-29Add an add_hosts_file routine that adds a "hosts" path to an array andGerald Combs1-1/+1
use it in tshark.c instead of read_hosts_file. This lets us use "-H" multiple times. Make read_hosts_file static. svn path=/trunk/; revision=46273
2012-10-24List -z compare,... in the statistics documentation. Maybe someone who ↵Chris Maynard1-1/+6
actually knows how to use it could elaborate? svn path=/trunk/; revision=45769
2012-10-23Inspired by ↵Chris Maynard1-0/+6
http://www.wireshark.org/lists/wireshark-users/201206/msg00025.html, add support for being able to specify a numeric range as the <selector> part of tshark's -d <layer type>==<selector>,<decode-as protocol> option. svn path=/trunk/; revision=45734
2012-07-08First phase of fixing https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7380 :Jeff Morriss1-0/+3
Add a new name resolution option: whether or not use the configured (in the OS) name resolver (e.g., DNS) to resolve network names. When this option is disabled but network name resolution is enabled then Wireshark will resolve only those names that it can from local sources. This includes (at least, AFAIK): - name resolutions that Wireshark picks up on from DNS packets it decodes - the "user hosts file" (~/.wireshark/hosts on *NIX) - what Wireshark reads out of capture file (the PCAPNG name resolution block) This new preference defaults to "use external resolvers" for backward compatibility (so people turning on network name resolution will get the old behavior). This option can be set via Edit->Preferences and on the command line; there remain several UIs (e.g., the "open capture file" dialog, the View->Name Resolution menu, etc.) that don't have the new option yet. Also expand on the "description" for the name resolution preferences: these are used not only in the tooltips but are also written to the preferences file. The previous text didn't include enough context when written do the preferences file. svn path=/trunk/; revision=43605
2012-06-19Remove what appears to be an errant vi/vim command and add a newline.Gerald Combs1-1/+1
svn path=/trunk/; revision=43371
2012-03-19Fix a typo or twoJeff Morriss1-2/+2
svn path=/trunk/; revision=41657
2012-03-19Add a new environment variable (WIRESHARK_ABORT_ON_OUT_OF_MEMORY) thatJeff Morriss1-3/+10
prevents OutOfMemory exceptions from being thrown. This makes it easier to debug such conditions. Set this variable in test-fuzzed-cap.sh but not in fuzz-test.sh; it's nice to see the friendly out-of-memory error message in the bug reports the latter script generates. svn path=/trunk/; revision=41656
2012-03-15Sort the -z options.Chris Maynard1-250/+250
svn path=/trunk/; revision=41560
2012-02-27Add documentation for the the tshark follow tcp/udp streams feature addedJeff Morriss1-3/+58
with https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6684 svn path=/trunk/; revision=41212
2012-02-07Update the documentation to match the sort order. This documentation error ↵Chris Maynard1-1/+1
was pointed out by Markus Amend on -users. Reference: http://article.gmane.org/gmane.network.wireshark.user/14477 (BTW, I quickly scanned through tap-iousers.c:iousers_draw() and the sorting seems to be very inefficient.) svn path=/trunk/; revision=40911
2012-02-03The libpcap puts pcap-filter into the misc section (which seems to be 7).Jörg Mayer1-3/+3
Refer to pcap-filter and mention tcpdump only as a fallback. svn path=/trunk/; revision=40820
2011-11-30Add missing comments in syntax description for -z expertMartin Mathieson1-1/+1
svn path=/trunk/; revision=40050
2011-11-30Change the -z args for expert item. You can now give the minimum severity ↵Martin Mathieson1-6/+7
level to report as well as a filter. Also, now show duplicate reports only once, and give the frequency rather than the frame number. svn path=/trunk/; revision=40049
2011-11-08From Michael Mann via ↵Chris Maynard1-3/+3
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6377, with the tshark man page update by me: tshark -z io,stat,interval,"[SUM|MIN|MAX|AVG](field)field [and filter]" should support floating point. svn path=/trunk/; revision=39767
2011-09-28Rather than complain and quit if -V is missing when -O <protocols> is used, ↵Chris Maynard1-4/+11
do the user a favor and continue as if -V had been specified. Add explicit documentation of the -O <protocols> option to the man page. svn path=/trunk/; revision=39175
2011-09-27Add a new tshark option for being able to specify an alternate line ↵Chris Maynard1-10/+20
separator between packets. The option chosen was "-S <separator>". The former -S option was renamed to -P, and the former -P option, which was previously undocumented, was renamed to -2. This fixes https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5342. svn path=/trunk/; revision=39168
2011-09-23Fix a couple of typos and use 2 spaces consistently after a period.Chris Maynard1-65/+65
svn path=/trunk/; revision=39092
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-29 10:08:03 +0000