0

I can display the source and destination tcp ports with 

tshark -T fields -e tcp.port
1111,2222
2222,1111
[...]

How can I display only the source port in order to get 

1111
2222
user123456
  • 563
  • 1
  • 7
  • 20

1 Answers1

4

Like this

tshark -e tcp.srcport -T fields
Dmitry Zayats
  • 1,378
  • 7
  • 7
  • And the way to find it - is via tshark -G. This will print all possible supported fields and then you just search in the output field that interests you – Dmitry Zayats Nov 11 '16 at 23:04