From b52437ba28062ed468aebc5e8b82b163f44e12e9 Mon Sep 17 00:00:00 2001 From: Chuck Craft Date: Thu, 7 Apr 2022 12:41:06 -0500 Subject: [PATCH] WSUG/tshark: protocol summary and output with "-e" --- doc/tshark.adoc | 11 +++++++---- docbook/wsug_src/WSUG_chapter_use.adoc | 4 ++-- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/doc/tshark.adoc b/doc/tshark.adoc index 10c75b5c1d..df169e1537 100644 --- a/doc/tshark.adoc +++ b/doc/tshark.adoc @@ -350,10 +350,13 @@ selected. Column names may be used prefixed with "_ws.col." Example: *tshark -e frame.number -e ip.addr -e udp -e _ws.col.Info* -Giving a protocol rather than a single field will print multiple items -of data about the protocol as a single field. Fields are separated by -tab characters by default. *-E* controls the format of the printed -fields. +Fields are separated by tab characters by default. *-E* controls the +format of the printed fields. +Giving a protocol rather than a single field will print the protocol summary +(subtree label) from the packet details as a single field. +If the protocol summary contains only the protocol name +(e.g. "Hypertext Transfer Protocol") then the protocol filter name ("http") +will be printed. -- -E :: diff --git a/docbook/wsug_src/WSUG_chapter_use.adoc b/docbook/wsug_src/WSUG_chapter_use.adoc index 3ad057d106..85d0cc933b 100644 --- a/docbook/wsug_src/WSUG_chapter_use.adoc +++ b/docbook/wsug_src/WSUG_chapter_use.adoc @@ -1006,8 +1006,8 @@ pane) in a more detailed form. image::wsug_graphics/ws-details-pane.png[{screenshot-attrs}] This pane shows the protocols and protocol fields of the packet selected in the -“Packet List” pane. The protocols and fields of the packet shown in a tree -which can be expanded and collapsed. +“Packet List” pane. The protocol summary lines (subtree labels) and fields of the +packet are shown in a tree which can be expanded and collapsed. There is a context menu (right mouse click) available. See details in <>.