Question

我正在尝试运行以下tshark命令：

tshark -r $file -T fields -E separator=/t -e frame.number -e frame.time -e frame.protocols -e frame.len -e frame.interface_id -e frame.interface_name

我收到此警告：

** (process:30955): WARNING **: 'frame.interface_name' isn't a valid field! tshark: Some fields aren't valid

但是在Wireshark中打开文件时我可以看到该字段吗？

访问interface_name信息的正确方法是什么？

我正在使用以下tshark版本-

TShark 1.12.1 (Git Rev Unknown from unknown)

Copyright 1998-2014 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.32.4, with libpcap, with libz 1.2.7, with POSIX
capabilities (Linux), with libnl 3, with SMI 0.4.8, with c-ares 1.9.1, with Lua
5.2, without Python, with GnuTLS 2.12.20, with Gcrypt 1.5.0, with MIT Kerberos,
with GeoIP.

Running on Linux 3.16.7-cb2000v1, with locale en_US.UTF-8, with libpcap version
1.3.0, with libz 1.2.7.
Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz

Built using gcc 4.7.2.

我尝试更新Wireshark-

$ sudo apt-get install wireshark Reading package lists... Done Building dependency tree Reading state information... Done wireshark is already the newest version. You might want to run 'apt-get -f install' to correct these: The following packages have unmet dependencies: isc-dhcp-relay : Depends: isc-dhcp-common (= 4.2.2.dfsg.1-5+deb70u8) but 4.2.2.dfsg.1-5+deb70u8 is to be installed isc-dhcp-server : Depends: isc-dhcp-common (= 4.2.2.dfsg.1-5+deb70u8) but 4.2.2.dfsg.1-5+deb70u8 is to be installed libsnmp-perl : Depends: perl (>= 5.14.2-21+deb7u5) but 5.14.2-21+deb7u3 is to be installed E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution).

上面写着wireshark is already the newest version。

这是机器的Linux OS详细信息： Distributor ID: Debian Description: Debian GNU/Linux 7.8 (wheezy) Release: 7.8 Codename: wheezy

Answer 1

您正在使用哪个版本的tshark？运行tshark -v进行检查。

frame.interface_name 显示过滤器仅从版本2.4.0开始可用，因此您的tshark中是否有%PATH%的较旧版本？

请注意，您可以在Wireshark Display Filter Reference页面上检查任何显示过滤器的可用性。

如何使用tshark从.pcapng文件读取接口名称？

1 个答案: