Re: Tshark usage in replaying icmpv6 messages

[Guy Harris <guy () alum mit edu>]

On Aug 3, 2012, at 12:39 PM, naresh gudipudi wrote:

> Yes, it is reading, not replaying.My mistake. I am specifying the fields with -e option. for example, the Target 
> Address field(in icmpv6 header) in icmpv6 neighbor solicitaion message(icmpv6 type = 135) sent to solicited-node 
> multicast address, i am specifying the filter as icmpv6.nd.ns.target_address. When this filter is used in wireshark 
> GUI, it works. But in tshark, what all i can see is a nothing.

OK, so you have, for example, a capture file that, when you read it into Wireshark, and use 
"icmpv6.nd.ns.target_address" as a filter expression, it shows some packets, meaning that those packets have the 
"icmpv6.nd.ns.target_address" field in them, but if you run TShark with that capture file and with "-T fields" and "-e 
icmpv6.nd.ns.target_address", it doesn't print anything?

If so, then, if you have a capture file that shows that behavior and that you can make public by putting it into a bug, 
could you file a bug at

        http://bugs.wireshark.org/

and attach the capture file to the bug?  I have a capture with "icmpv6.nd.ns.target_address" in one of the packets in 
it, and when I run a recent build of TShark from the trunk on that capture file with "-T fields" and "-e 
icmpv6.nd.ns.target_address", it prints the target address.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe