I am trying to run this tshark command :
tshark -r $file -T fields -E separator=/t -e frame.number -e frame.time -e frame.protocols -e frame.len -e frame.interface_id -e frame.interface_name
I get this warning :
** (process:30955): WARNING **: 'frame.interface_name' isn't a valid field!
tshark: Some fields aren't valid
But I am able to see the field when I open the file in Wireshark ?
What is the right way to access the interface_name info?
I am using the following tshark version -
TShark 1.12.1 (Git Rev Unknown from unknown)
Copyright 1998-2014 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.32.4, with libpcap, with libz 1.2.7, with POSIX
capabilities (Linux), with libnl 3, with SMI 0.4.8, with c-ares 1.9.1, with Lua
5.2, without Python, with GnuTLS 2.12.20, with Gcrypt 1.5.0, with MIT Kerberos,
with GeoIP.
Running on Linux 3.16.7-cb2000v1, with locale en_US.UTF-8, with libpcap version
1.3.0, with libz 1.2.7.
Intel(R) Xeon(R) CPU E5-2640 v4 @ 2.40GHz
Built using gcc 4.7.2.
I tried updating wireshark -
$ sudo apt-get install wireshark
Reading package lists... Done
Building dependency tree
Reading state information... Done
wireshark is already the newest version.
You might want to run 'apt-get -f install' to correct these:
The following packages have unmet dependencies:
isc-dhcp-relay : Depends: isc-dhcp-common (= 4.2.2.dfsg.1-5+deb70u8) but 4.2.2.dfsg.1-5+deb70u8 is to be installed
isc-dhcp-server : Depends: isc-dhcp-common (= 4.2.2.dfsg.1-5+deb70u8) but 4.2.2.dfsg.1-5+deb70u8 is to be installed
libsnmp-perl : Depends: perl (>= 5.14.2-21+deb7u5) but 5.14.2-21+deb7u3 is to be installed
E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution).
It says wireshark is already the newest version.
This is the linux OS details of the machine :
Distributor ID: Debian
Description: Debian GNU/Linux 7.8 (wheezy)
Release: 7.8
Codename: wheezy
Which version of tshark are you using? Run tshark -v to check.
The frame.interface_name display filter is only available beginning with version 2.4.0, so maybe you have an older version of tshark in your %PATH%?
Note that you can check for the availability of any display filter on the Wireshark Display Filter Reference Page.