aboutsummaryrefslogtreecommitdiffstats
path: root/doc/tshark.pod
AgeCommit message (Collapse)AuthorFilesLines
2019-08-25tshark: Complement manual page synopsisJaap Keuter1-1/+2
Add '-J' option to synopsis and reshuffle '-j' to correct place. Change-Id: I351b3ce464fca3b52a75614e1e8f8c91f9a30df2 Reviewed-on: https://code.wireshark.org/review/34352 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann <mmann78@netscape.net>
2019-07-29doc: document WIRESHARK_CONFIG_DIRPeter Wu1-4/+5
WIRESHARK_CONFIG_DIR was introduced with Wireshark 3.0 and is more cross-platform than WIRESHARK_APPDATA. The latter was presumably created for use by PortableApps. Let's consider that an internal, undocumented detail that might be change, and document WIRESHARK_CONFIG_DIR instead. Change-Id: I0042d607b282cc6dee4b017b1e80b44087bd62e9 Reviewed-on: https://code.wireshark.org/review/34113 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Jeff Morriss <jeff.morriss.ws@gmail.com>
2019-07-20Documentation: convert http URLS to httpsPeter Wu1-1/+1
Remove some dead links or point them to archive.org while at it. All updated links have been verified. Change-Id: Icf02167a13d5fe9dfce39ea57525b3f185554c9d Reviewed-on: https://code.wireshark.org/review/34028 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-06-26tap: add credentials tap.Dario Lombardo1-0/+7
This new tap collects credentials (username and paassword) from the dissectors. So far, few dissectors have been instrumented: - http (basic auth) - http (header auth) - ftp Others can be instrumented as well using the same technique. Tshark has a new option (-z credentials) and Wireshark a new "tools" menu: the documentation has been updated accordingly. Change-Id: I2d0d96598c85bb3ea4fb5ec090dd8dc28b481fc9 Reviewed-on: https://code.wireshark.org/review/33453 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Dario Lombardo <lomato@gmail.com>
2019-05-07Update tshark man pages for -j and -JMoshe Kaplan1-10/+12
Change-Id: I221013d5948c4c699b1721441b54a05dc5ff2ce2 Reviewed-on: https://code.wireshark.org/review/33089 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-03-26Update documentation of -G plugins.Guy Harris1-2/+2
Change-Id: Id057003924475c3c1241b156f7da3455b00a3560 Reviewed-on: https://code.wireshark.org/review/32590 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-03-23Clean up the new-file selection criteria in the GUI.Jeff Morriss1-1/+2
Inspired by looking into https://ask.wireshark.org/question/8009/wireshark-ring-buffer-settings-from-command-line/ ... in which the user was confused because a duration set on the command line was not reflected in the GUI. That's because I0180c43843f5d2f0c2f50153c9ce42ac7fa5aeae added the `interval` ring-buffer option and made the GUI use this rather than `duration`. This was not at all clear in the GUI, though. Since `duration` and `interval` have quite different use cases, expose both in the GUI. Try to clean up and unify the tooltips at the same time. I'm not entirely convinced the tooltips need to be on the checkbox, the spinbox, and the combobox but leave it that way for now. Add some to the man page description of the interval option to hopefully make it clearer what the option does. Change-Id: I3b45fe71c33af64d980dffb5e5ba93e2a15a6b96 Reviewed-on: https://code.wireshark.org/review/32526 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-03-08Docs: Mention Npcap in our man pages.Gerald Combs1-4/+4
Mention Npcap whereever we mention WinPcap. Change-Id: I6ee295ca88302e2516d5658a5d528f9675209da8 Reviewed-on: https://code.wireshark.org/review/32352 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-02-26The non-flag arguments to tshark aren't necessarily a capture filter.Guy Harris1-1/+1
They're a capture filter if you're capturing live traffic; they're a display (read) filter if you're reading a capture file. Change-Id: Ia2f5bcdb0098bf3c2b4a3d99da5bfe768e09b5a0 Reviewed-on: https://code.wireshark.org/review/32207 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2019-01-06[Automatic update for 2019-01-06]Gerald Combs1-1/+1
Update manuf, services enterprise numbers, translations, and other items. Change-Id: I0e282baebc0cda0e54e49eff60827eec02f6f797 Reviewed-on: https://code.wireshark.org/review/31402 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-12-29Add jsonraw to tshark's -T man page synopsisJim Young1-1/+1
Change-Id: Icf3dacb143b19a55788a30dac297787ab3d2c3f0 Reviewed-on: https://code.wireshark.org/review/31242 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-12-07PCAP/PCAPNG: Be consistent in documentation, etcJaap Keuter1-4/+4
1) The default build configuration is to select PCAPNG as output format, but it can be selected as PCAP. Some of the command line tools have the option to select the output format and default towards the build configuration. This has to be reflected in their help output also. 2) Various documentation files are still stating that PCAP is the default format of various tools. With the default build configuration being PCAPNG these have to be adjusted as well. (with lack of dynamic content the documentation can only refer to the default build configuration format). Change-Id: I51d19642a7ed8c99817971c1f25d20972095021e Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl> Reviewed-on: https://code.wireshark.org/review/30951 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-12-06Doc: add mentioning of ip link to get interfacesJaap Keuter1-1/+1
With the introduction of the ip command (from iproute2) on modern Linux systems it becomes common to see this tool available, gradually replacing tools like netstat and ifconfig. Change-Id: I1fb309e741c07c93271b61a35c4833d36bcc5cb8 Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl> Reviewed-on: https://code.wireshark.org/review/30924 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-12-02[Automatic update for 2018-12-02]Gerald Combs1-1/+1
Update manuf, services enterprise numbers, translations, and other items. Change-Id: Idfe3eaa6b9abd2337590a09972ce44266c2893ca Reviewed-on: https://code.wireshark.org/review/30880 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-11-16Man pages: Update pipe input documentation.Gerald Combs1-7/+6
Make sure the -i <pipe> documentation is consistent and correct. Change-Id: I9019effb658f914ac754e4ae893eafbe7c4b4da1 Reviewed-on: https://code.wireshark.org/review/30675 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-11-13tshark: Print the packets' comments in the expert infoVasil Velichkov1-1/+1
Previously 'tshark -z expert' was failing with abort when a packet contains a comment - Add a new comment parameter and update the tshark's manual page - Add a new comment_level severity and change the default lavel to it. - Add various 'tshark -z expert' tests Change-Id: I188317da5e00019b8f2b725f0fe84942f774520f Reviewed-on: https://code.wireshark.org/review/30610 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-11-09Dumpcap+Qt: Add support for `-a packets:NUM` and `-b packets:NUM`.Gerald Combs1-9/+16
Add the ability to rotate files after a specified number of packets (`-b packets:NUM`). Move some condition checks to capture_loop_write_packet_cb. Add `-a packets:NUM` in order to be consistent. It is functionally equivalent to the `-c` flag. Add a corresponding "packets" option to the Capture Interfaces dialog Output tab. Add initial tests for autostop and ringbuffer conditions. Change-Id: I66eb968927ed287deb8edb96db96d7c73526c257 Reviewed-on: https://code.wireshark.org/review/30534 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-11-01Move condition logic to dumpcap.cGerald Combs1-2/+3
Move the condition logic from capture_stop_conditions.c to dumpcap.c. Remove capture_stop_conditions.[ch] and conditions.[ch]. Switch duration values to doubles. Change-Id: Ifa74fb13ec8fc923b0721597a6cf071d72069ea0 Reviewed-on: https://code.wireshark.org/review/30440 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-10-05*shark: Update help and manpage for name resolvingUli Heilmeier1-0/+2
Add 'v' option for VLAN ID resolving and get rid of deprecated 'C' option. Bug: 14826 Change-Id: I63104f4a465d251048693ad02882ea7eb2c4d926 Reviewed-on: https://code.wireshark.org/review/30029 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-09-13Start renaming SSL to TLS.Gerald Combs1-4/+4
Rename the "ssl" protocol to "tls" and add an "ssl" alias. Prefer "TLS" over "SSL" in user interface text and in the documentation. Fix the test_tls_master_secret test while we're here. Bug: 14922 Change-Id: Iab6ba2c7c4c0f8f6dd0f6d5d90fac5e9486612f8 Reviewed-on: https://code.wireshark.org/review/29649 Petri-Dish: Gerald Combs <gerald@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Gerald Combs <gerald@wireshark.org>
2018-09-09Remove the tshark -z compare featureJoão Valverde1-5/+0
- It cannot support IPv6. - Non-standard use (specifically recommended against in the RFCs) of the IPv4 fragment ID field. - Has a narrow and non-obvious use case, IMO. - It is not supported in the Qt GUI. - Significant maintenance burden for an obscure feature. Change-Id: Icaf429269dc42f78c38b8d20001508132499faf8 Reviewed-on: https://code.wireshark.org/review/29239 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: João Valverde <j@v6e.pt>
2018-08-18Docs: Make our Pod documentation encoding uniform.Gerald Combs1-0/+5
We've set "=encoding utf8" in wireshark.pod for a long time. Do so in the rest of our .pod files. Change-Id: I3ef0fb3a88ed63275b4ff4362b6afbf13d79a0bc Reviewed-on: https://code.wireshark.org/review/29182 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2018-04-19tshark: prepend tshark to all examples in doc.Dario Lombardo1-20/+20
The doc has a mixed way of providing example, both without executable name and with it. Add it to all the provided examples. Add highlight of tshark in examples, too. Change-Id: I99d83201cc897629f186aabd20c0add9c7c53b93 Reviewed-on: https://code.wireshark.org/review/27034 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2018-04-19tshark: improve -G elastic-mapping command by adding filters.Dario Lombardo1-2/+15
The generated elastic mapping file is huge and it can hassle softwares like Kibana. This change adds the ability to append desired filters that will appear in the mapping file. This change adds the option --elastic-mapping-filter <protocols> to tshark. Example: tshark -G elastic-mapping --elastic-mapping-filter ip,udp,dns make only those 3 protocols to appear in the mapping file. Change-Id: Ie2dcd6e44be2d084e8e50cd6554bd90178da4e38 Reviewed-on: https://code.wireshark.org/review/27001 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Dario Lombardo <lomato@gmail.com>
2018-04-18tshark: add -G elastic-mapping report.Dario Lombardo1-0/+6
This option generates an ElasticSearch mapping file as described here: https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana It leverages the Glib-json library. Change-Id: Iff25f991e87d3da07bf06654e353fb785799dde9 Reviewed-on: https://code.wireshark.org/review/26848 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Dario Lombardo <lomato@gmail.com>
2018-02-28tshark(.pod): fix spelling-error-in-manpage found by lintianAlexis La Goutte1-1/+1
inital => initial Change-Id: Id92a853bd6b24e06b2f6074903f8e89249c6c2cc Reviewed-on: https://code.wireshark.org/review/26168 Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-02-19Reorganize and expand the description section.Guy Harris1-90/+139
Try to do a better job of explaining the behavior with various combination of options. There are a lot of different output options, and combinations of those options, for TShark; try to cover more of them - it's complicated. Consistently refer to command-line "options" rather than "flags". Change-Id: Idbe6d22a07920789b3d5ed46a700e654a5ac0ae3 Reviewed-on: https://code.wireshark.org/review/25902 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-18Note that -P can override -Q's suppression of packet output.Guy Harris1-1/+2
Change-Id: I38da07fb68a3b8c62e2267a06a9ba41ff80e7497 Reviewed-on: https://code.wireshark.org/review/25893 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-02-17Add `-z http_ref,tree` to the tshark man page.Gerald Combs1-0/+5
Change-Id: Ia7b229fc4c42bd967ee4315543f58f6c05be5510 Reviewed-on: https://code.wireshark.org/review/25827 Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-01-09Use pcapng as the name of the file format.Guy Harris1-1/+1
At one point, I remember a discussion resulting in the official name of the next-generation replacement for pcap format being changed to "pcapng", with no hyphen. Make Wireshark reflect that. Change-Id: Ie66fb13a0fe3a8682143106dab601952e9154e2a Reviewed-on: https://code.wireshark.org/review/25214 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-01-06TShark: Fix color handling on Windows.Gerald Combs1-5/+6
Use SetConsoleTextAttribute to reset our colors on Windows. Update the release notes and man page. Change-Id: I2bc309787f9c2331324503092bd1c9ae6360eb55 Reviewed-on: https://code.wireshark.org/review/25170 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-10-30tshark doc updatesGraham Bloice1-0/+5
After other changes, add info about -G help and update output from -G dissector-tables. Change-Id: I339d5c31a606720ef92e641e59ec5a45114321a8 Reviewed-on: https://code.wireshark.org/review/24188 Reviewed-by: Graham Bloice <graham.bloice@trihedral.com>
2017-10-15Tshark: Optional packet summary for ElasticsearchChristoph Wurm1-3/+6
Currently, the Elasticsearch output exports the packet details and, if -x is specified, the raw hex data. This change adds the option of exporting the packet summary as well. The default stays the same (packet details only), but now the existing -P switch turns on printing of the packet summary. It also turns off printing packet details, which can be turned back on with -V to print both, and combined with -x to print all three: summary, details and raw hex. The packet summary is especially useful when exploring and visualizing the data in Kibana, e.g. by displaying the summary "Info" field/column in a table, as in the Wireshark GUI. Change-Id: I2030490cfdd905572397bc3d5457ba49d805a5c4 Reviewed-on: https://code.wireshark.org/review/22716 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-10-11Add --print as an alias for -P, to match tcpdump.Guy Harris1-3/+9
tcpdump just got a --print option, which causes packet information to be printed even if the raw packets are being saved to a file with -w. We have -P for the same purpose; make --print another name for it. While we're at it: document --help and --version; just speak of -P/--print as causing printing even of the packet details, even though -V forces printing with -w, for consistency with how --print is documented for tcpdump; fix the description of -h/--help. Change-Id: Idf650a202a09a2d1682edbd9d76123f1b1412b55 Reviewed-on: https://code.wireshark.org/review/23888 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-09-22Add Flow Graph functionality to TSharkMichael Mann1-0/+20
Add flow graph functionality to tshark through -z option. Output is same as ASCII format saved from GUI. Change-Id: Iee0bfea7215858e6488b4728581be28287e9ea1a Reviewed-on: https://code.wireshark.org/review/23652 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-08-22Add hardware timestamping supportAhmad Fatoum1-0/+11
pcap provides a pcap_set_tstamp_type function, which can be used to request hardware timestamps from a supporting kernel. This patch adds support for aforementioned function as well as two new command line options to dumpcap, wireshark and tshark: --list-time-stamp-types List time stamp types supported for the interface --time-stamp-type <type> Change the interface's timestamp method Name choice mimics those used by tcpdump(1), which already supports this feature. However, unlike tcpdump, we provide both options unconditionally. If Wireshark was configured without pcap_set_tstamp_type being available, --list-time-stamp-types reports an empty list. Change-Id: I418a4b2b84cb01949cd262aad0ad8427f5ac0652 Signed-off-by: Ahmad Fatoum <ahmad.fatoum@siemens.com> Reviewed-on: https://code.wireshark.org/review/23113 Petri-Dish: Guy Harris <guy@alum.mit.edu> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-07-03Add option to use wall-clock intervalsSake Blok1-4/+7
Add the "interval" option to "-b". Each new capture starts at the exact start of a time interval. For instance, using -b interval:3600 will start a new capture file at each whole hour. Changed the duration option in the GUI interfaces to use the new interval option. Change-Id: I0180c43843f5d2f0c2f50153c9ce42ac7fa5aeae Reviewed-on: https://code.wireshark.org/review/22428 Petri-Dish: Anders Broman <a.broman58@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Sake Blok <sake.blok@SYN-bit.nl>
2017-06-22Add --no-duplicate-keys tshark option.Daan De Meyer1-0/+7
Adds the --no-duplicate-keys option to tshark. If -T json is specified, this option can be specified in order to transform the duplicate keys produced by -T json into single keys with as value a json array of all separate values. Specifying --no-duplicate-keys changes the function which groups node children that is passed to write_json_proto_tree. Instead of a function that puts each node in a separate group (proto_node_group_children_by_unique) a function is passed that groups children that have the same json key together (proto_node_group_children_by_json_key). This will lead to some groups having multiple values. Groups with multiple values are written to the output as a json array. This includes normal json keys but also keys with the "_raw" and "_tree" suffix. If --no-duplicate-keys is specified with an option other than "-T json" or "-T jsonraw" or without -T an error is shown and tshark will exit. "Export Packet Dissections -> As JSON" in the GUI is hardcoded to use the duplicated keys format. Fixes one regression in the output where a filtered json key (-j) with both a value and children would not have the "_tree" suffix added to the json key containing the children. Includes a little code cleanup (removes one instance of code duplication and simplifies a while loop). Fixes a memory leak (I thought this fix was already included in the previous refactor patch but something must have gone wrong when updating the patch so I'm including it again in this patch). Bug: 12958 Change-Id: I401f8fc877b5c590686567c3c44cdb832e9e7dfe Reviewed-on: https://code.wireshark.org/review/22166 Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-12Add support for color xml attributes in psml and pdml formats.Michael Mann1-0/+4
Bug: 6682 Change-Id: I19330d06aa3d5692503c61369c3c650d595971f5 Reviewed-on: https://code.wireshark.org/review/22077 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Stephen Donnelly <stephen.donnelly@endace.com> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-11tshark: add "--color" option emulating wireshark colorsDave Goodell1-0/+9
With this commit, tshark will mimic the packet coloring present in the Wireshark GUI whenever "--color" is passed. This initial commit only adds such support for the standard text output format. A future commit could potentially broaden this support to other output modes (such as "-V" mode). Bug: 5158 Change-Id: I59329e32475b0c67e28802e79610544d4868ea2d Reviewed-on: https://code.wireshark.org/review/21325 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-05-05Auto reset epan sessionHessam Jalali1-0/+12
Automatically resets intarnal epan session after reaching to specified number of packets, for example -M 1000 will reset the session every 1000 packets. this is more like a proposal since the usage is very specific it is useful for 24/7 live capture with dissection and sending data directly to another application. example: tshark -Y "gtp" -M 100000 -T fields -e gtp.message -e gtp.teid Change-Id: I8ee8b0380017c684120a93cb3fb43f41615a9c04 Reviewed-on: https://code.wireshark.org/review/21312 Reviewed-by: Evan Huus <eapache@gmail.com> Petri-Dish: Evan Huus <eapache@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-04-17Clean up documentation and help messages for protocol enabling/disabling.Guy Harris1-2/+10
List all of --enable-protocol, --disable-protocol, --enable-heuristic, and --disable-heuristic in the SYNOPSIS section of the man pages. Undent after the list of taps for the -z option, so the following options are at the same indentation as other options. List --enable-protocol in the DESCRIPTION, above --disable-protocol. Include --enable-protocol in the help message. Change-Id: I680a54430789f3543b2d539fbded22b0b57f7f76 Reviewed-on: https://code.wireshark.org/review/21159 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2017-03-28Reflect new default value of snaplen in man pages.Martin Sehnoutka1-1/+1
Default value for snaplen is defined in wiretap/wtap.h: #define WTAP_MAX_PACKET_SIZE 262144 and used in capture_opts.c: capture_opts->default_options.snaplen = WTAP_MAX_PACKET_SIZE; but help and man pages don't reflect this change. Change-Id: I35ddf1e8b7ffd657f4e01b3fe6b4c44c9acece2b Reviewed-on: https://code.wireshark.org/review/20738 Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-19tshark: Optionally delimit packet summary columns with tabsJim Young1-2/+6
This patch augments tshark's -T report with a "tabs" option. When the -T tabs option is enabled an ASCII horizontal tab character is inserted between each column of the human-readable one-line packet summary record. Change-Id: Id10a6e21e231eb2e52b6342ed05399db1a5fcfdf Reviewed-on: https://code.wireshark.org/review/20537 Petri-Dish: Michael Mann <mmann78@netscape.net> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-03-03Update documentation with reference to $XDG_CONFIG_HOMEPeter Wu1-1/+3
Since v2.1.0rc0-184-gb0b53fa593, $XDG_CONFIG_HOME/wireshark (instead of $HOME/.wireshark) is used, clarify this in the WSUG and manuals. Change-Id: I74a6f9b86bd8d54ee326ca83d7536e091d6da08a Reviewed-on: https://code.wireshark.org/review/20364 Reviewed-by: Peter Wu <peter@lekensteyn.nl> Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2017-02-25json2pcap support addedMartin Kacer1-7/+21
Modified tshark -T json -x output Added tshark -T jsonraw output json2pcap.py (can be used for basic packet editing by modifying json) The modification in tshark -T json -x and new tshark -T jsonraw output add into hex-data output in JSON also information on which position each field is dissected in the original frame, what is the field length, bitmask (for not byte aligned fields) and type. This information can be used for latter processing. One use-case is json2pcap script which assembles the protocol layers back together from upper to lowers layers, which allows the basic packet modification/editing/rewriting. Change-Id: Ibf948eb8fc7e3b0b51c12df6c3855f705a9c7925 Reviewed-on: https://code.wireshark.org/review/19990 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Dario Lombardo <lomato@gmail.com> Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2016-12-03tshark: Add -G folders reportJim Young1-0/+7
Add a new tshark feature to generate a folders report. The folders report is essentially the information presented by Wireshark's About / Folders page in a TAB delimited format. Change-Id: Ic4b3d332b4bdaa7e6b7aad1e9cc5dd18413aada6 Reviewed-on: https://code.wireshark.org/review/19002 Petri-Dish: Jim Young <jim.young.ws@gmail.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-12-02Enable exporting objects with tsharkMoshe Kaplan1-0/+13
A new "--export-object <protocol>,<destdir>" option is added to tshark. This required refactoring Export Object behavior in all GUIs to give the export object handling to the dissector, rather than the ui layer. Included in the refactoring was fixing some serious memory leaks in Qt Export Object dialog, crash due to memory scope issues in GTK Export Object dialog, and addition sorting column feature in Qt dialog (set up by creating a widget to manage the items that were previously leaking memory) Bug: 9319 Ping-Bug: 13174 Change-Id: I515d7662fa1f150f672b1476716f347ec27deb9b Reviewed-on: https://code.wireshark.org/review/18927 Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Tested-by: Michael Mann <mmann78@netscape.net> Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-10-04Man pages: Update -D flag text.Gerald Combs1-3/+3
Refer to "Windows" instead of "Windows 2000". Add an "ip link show" breadcrumb. Change-Id: Ie1faa1d30b0ac63de35b0385cbb1306f08828e61 Reviewed-on: https://code.wireshark.org/review/18056 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2016-07-15Fix manpages typo.João Valverde1-1/+1
Change-Id: Iac747655d09c94926e51c7ea1f23375650cd6641 Ping-Bug: 12305 Reviewed-on: https://code.wireshark.org/review/16446 Reviewed-by: João Valverde <j@v6e.pt> Reviewed-by: Michael Mann <mmann78@netscape.net>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-22 00:42:50 +0000