Quicktip: TShark's Options -e and -T, (Sun, Dec 26th)

When you use TShark’s option -e to display a field value, you need to include option -Tfields.

You don’t actually have to memorize this, TShark will help you when you use option -e without option -T:

And by doing so, you learn about other output formats, like JSON:


Didier Stevens
Senior handler
Microsoft MVP

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Reposted from SANS. View original.