Sake Blok, a Wireshark/Ethereal devotee since 1999, works as a Research & Development Engineer for ion-ip in the Netherlands (http://www.ionip.com) . His company provides solutions to customers who want to deliver their applications to users in a fast, secure, efficient and scalable manner. Sake\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'s main focus is to take new products for a spin in their test environment, design custom solutions for customers and troubleshoot the problems customers might encounter while using ion-ip solutions. Two years ago (2006), Sake started to add the functionality he was missing to Wireshark. He also started to fix Wireshark-bugs that were reported on Bugzilla. This work on Wireshark resulted in an invitation from Gerald Combs to join the Wireshark Core Development Team in 2007.

1. Tsharks output formats December 2008

5. Example of output with -V $ tshark -r client.cap -R http.request -V Frame 4 (160 bytes on wire, 160 bytes captured) Arrival Time: Sep 23, 2008 22:31:59.249141000 [Time delta from previous captured frame: 0.000589000 seconds] [Time delta from previous displayed frame: 0.002689000 seconds] [Time since reference or first frame: 0.002689000 seconds] Frame Number: 4 Frame Length: 160 bytes Capture Length: 160 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:http] Ethernet II, Src: IntelCor_61:3a:ad (00:1c:bf:61:3a:ad), Dst: JuniperN_bb:d1:3b (00:12:1e:bb:d1:3b) Destination: JuniperN_bb:d1:3b (00:12:1e:bb:d1:3b) Address: JuniperN_bb:d1:3b (00:12:1e:bb:d1:3b) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: IntelCor_61:3a:ad (00:1c:bf:61:3a:ad) Address: IntelCor_61:3a:ad (00:1c:bf:61:3a:ad) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.46 (192.168.1.46), Dst: 192.168.1.20 (192.168.1.20) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 146 Identification: 0x588c (22668) Flags: 0x04 (Don't Fragment) [ rest of output omitted ]

8. Example of output with -T fields $ tshark -r client.cap -R "tcp.len>0" -T fields -e frame.time_relative -e ip.src -e ip.dst -e tcp.len 0.002689000 192.168.1.46 192.168.1.20 106 0.024024000 192.168.1.20 192.168.1.46 375 $ $ tshark -r client.cap -R http.response -T fields -E header=y -e frame.time -e http.response.code -e http.content_length frame.time http.response.code http.content_length Sep 23, 2008 22:31:59.270476000 200 45 $ $ tshark -r client.cap -R http.response -T fields -E header=y -E separator=',' -E quote=d -e frame.time_relative -e http.response.code -e http.content_length frame.time_relative,http.response.code,http.content_length "0.024024000","200","45" $

10. Example of output with -T pdml $ tshark -r client.cap -R http.request -T pdml <?xml version=&quot;1.0&quot;?> <pdml version=&quot;0&quot; creator=&quot;wireshark/1.1.2-SVN-26732&quot;> <packet> <proto name=&quot;geninfo&quot; pos=&quot;0&quot; showname=&quot;General information&quot; size=&quot;160&quot;> <field name=&quot;num&quot; pos=&quot;0&quot; show=&quot;4&quot; showname=&quot;Number&quot; value=&quot;4&quot; size=&quot;160&quot;/> <field name=&quot;len&quot; pos=&quot;0&quot; show=&quot;160&quot; showname=&quot;Packet Length&quot; value=&quot;a0&quot; size=&quot;160&quot;/> <field name=&quot;caplen&quot; pos=&quot;0&quot; show=&quot;160&quot; showname=&quot;Captured Length&quot; value=&quot;a0&quot; size=&quot;160&quot;/> <field name=&quot;timestamp&quot; pos=&quot;0&quot; show=&quot;Sep 23, 2008 22:31:59.249141000&quot; showname=&quot;Captured Time&quot; value=&quot;1222201919.249141000&quot; size=&quot;160&quot;/> </proto> <proto name=&quot;frame&quot; showname=&quot;Frame 4 (160 bytes on wire, 160 bytes captured)&quot; size=&quot;160&quot; pos=&quot;0&quot;> <field name=&quot;frame.time&quot; showname=&quot;Arrival Time: Sep 23, 2008 22:31:59.249141000&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;Sep 23, 2008 22:31:59.249141000&quot;/> <field name=&quot;frame.time_delta&quot; showname=&quot;Time delta from previous captured frame: 0.000589000 seconds&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;0.000589000&quot;/> <field name=&quot;frame.time_delta_displayed&quot; showname=&quot;Time delta from previous displayed frame: 0.002689000 seconds&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;0.002689000&quot;/> <field name=&quot;frame.time_relative&quot; showname=&quot;Time since reference or first frame: 0.002689000 seconds&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;0.002689000&quot;/> <field name=&quot;frame.number&quot; showname=&quot;Frame Number: 4&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;4&quot;/> <field name=&quot;frame.pkt_len&quot; showname=&quot;Packet Length: 160 bytes&quot; hide=&quot;yes&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;160&quot;/> <field name=&quot;frame.len&quot; showname=&quot;Frame Length: 160 bytes&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;160&quot;/> <field name=&quot;frame.cap_len&quot; showname=&quot;Capture Length: 160 bytes&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;160&quot;/> <field name=&quot;frame.marked&quot; showname=&quot;Frame is marked: False&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;0&quot;/> <field name=&quot;frame.protocols&quot; showname=&quot;Protocols in frame: eth:ip:tcp:http&quot; size=&quot;0&quot; pos=&quot;0&quot; show=&quot;eth:ip:tcp:http&quot;/> </proto> <proto name=&quot;eth&quot; showname=&quot;Ethernet II, Src: IntelCor_61:3a:ad (00:1c:bf:61:3a:ad), Dst: JuniperN_bb:d1:3b (00:12:1e:bb:d1:3b)&quot; size=&quot;14&quot; pos=&quot;0&quot;> [ rest of output omitted ]