How does Wireshark export the column information of a package separately

How does Wireshark export the column information of a package separately

Wireshark provides rich packet export capabilities. Users can export packets to various formats as needed. These format files contain a variety of information about the package. But in many cases, the user only needs to get the specific column information of the packet, such as the length of the packet and the protocol type. At this point, you need to use tshark as a command-line tool. It is a tool that comes with Wireshark. Using this tool, you can read the specified package capture file, and then save the specific data in it to a new file according to the user's requirements. The command format to implement this function is as follows:

Tshark-r example.pcap-T fields-e column1-e column2....

Where-r example.pcap means to read the specified grab file;-T fields represents the contents of the output column; and-e column1 specifies the column to be output. Users can use this option multiple times to specify multiple columns.