From 2a5ff70caab499848de0c327052d564a831ba559 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Tue, 29 May 2007 06:20:03 +0000 Subject: Document "-T fields". svn path=/trunk/; revision=21977 --- doc/tshark.pod | 42 ++++++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 14 deletions(-) (limited to 'doc') diff --git a/doc/tshark.pod b/doc/tshark.pod index a79b19dbc7..c650e7147e 100644 --- a/doc/tshark.pod +++ b/doc/tshark.pod @@ -205,33 +205,44 @@ This can be useful on systems that don't have a command to list them the number can be useful on Windows 2000 and later systems, where the interface name is a somewhat complex string. -Note that "can capture" means that B was able to open -that device to do a live capture. Depending on your system you may need to run tshark from an account -with special privileges (for example, as root) to be able to capture -network traffic. -If B is not run from such an account, it will not list -any interfaces. +Note that "can capture" means that B was able to open that +device to do a live capture. Depending on your system you may need to +run tshark from an account with special privileges (for example, as +root) to be able to capture network traffic. If B is not run +from such an account, it will not list any interfaces. =item -e EfieldE -Add a field to the list of fields to display if B<-T fields> is selected. This option can be used multiple times -on the command line. At least one field must be provided if the fields option is selected. +Add a field to the list of fields to display if B<-T fields> is +selected. This option can be used multiple times on the command line. +At least one field must be provided if the B<-T fields> option is +selected. Example: B<-e frame.number -e ip.addr -e udp> -Giving a protocol rather than a single field will print multiple items of data about the protocol as a single field. Fields are separated by tab characters by default. B<-E> controls the format of the printed fields. +Giving a protocol rather than a single field will print multiple items +of data about the protocol as a single field. Fields are separated by +tab characters by default. B<-E> controls the format of the printed +fields. =item -E Efield print optionE -Set an option controlling the printing of fields when B<-T fields> is selected. +Set an option controlling the printing of fields when B<-T fields> is +selected. Options are: -B If B, print a list of the field names given using B<-e> as the first line of the output; the field name will be separated using the same character as the field values. Defaults to B. +B If B, print a list of the field names given using B<-e> +as the first line of the output; the field name will be separated using +the same character as the field values. Defaults to B. -BEcharacterE Set the separator character to use for fields. If B tab will be used (this is the default), if B, s single space will be used. Otherwise any character that can be accepted by the command line as part of the option may be used. +BEcharacterE Set the separator character to +use for fields. If B tab will be used (this is the default), if +B, s single space will be used. Otherwise any character that can be +accepted by the command line as part of the option may be used. -B Set the quote character to use to surround fields. B uses double-quotes, B single-quotes, B no quotes (the default). +B Set the quote character to use to surround fields. B +uses double-quotes, B single-quotes, B no quotes (the default). =item -f Ecapture filterE @@ -393,7 +404,7 @@ captured B epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00) -=item -T pdml|psml|ps|text +=item -T pdml|psml|ps|text|fields Set the format of the output when viewing decoded packet data. The options are one of: @@ -414,6 +425,9 @@ B Text of a human-readable one-line summary of each of the packets, or a multi-line view of the details of each of the packets, depending on whether the B<-V> flag was specified. This is the default. +B The values of fields specified with the B<-e> option, in a +form specified by the B<-E> option. + =item -v Print the version and exit. -- cgit v1.2.3