https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16656
Guy Harris <ghar...@sonic.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CONFIRMED |INCOMPLETE
--- Comment #4 from Guy Harris <ghar...@sonic.net> ---
Currently, we have:
"json", which looks like
[
{
"_index": "packets-1999-05-19",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "1",
"frame.time": "May 19, 1999 17:48:39.708517000 PDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161319.708517000",
"frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000",
"frame.time_relative": "0.000000000",
"frame.number": "1",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.file_off": "24",
"frame.protocols": "eth:ethertype:arp"
},
"eth": {
"eth.dst": "ff:ff:ff:ff:ff:ff",
"eth.dst_tree": {
"eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215",
"eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast",
"eth.addr.oui": "16777215",
"eth.dst.lg": "1",
"eth.lg": "1",
"eth.dst.ig": "1",
"eth.ig": "1"
},
"eth.src": "00:ab:cd:ef:01:23",
"eth.src_tree": {
"eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426",
"eth.src.oui_resolved": "Example Networks",
"eth.addr": "00:ab:cd:ef:01:23",
"eth.addr_resolved": "Example_ef:01:23",
"eth.addr.oui": "57426",
"eth.addr.oui_resolved": "Example Networks",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000806",
"eth.padding":
"00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"
},
"arp": {
"arp.hw.type": "1",
"arp.proto.type": "0x00000800",
"arp.hw.size": "6",
"arp.proto.size": "4",
"arp.opcode": "1",
"arp.src.hw_mac": "00:ab:cd:ef:01:23",
"arp.src.proto_ipv4": "192.168.4.1",
"arp.dst.hw_mac": "00:00:00:00:00:00",
"arp.dst.proto_ipv4": "192.168.4.255"
}
}
}
},
...
{
"_index": "packets-1999-05-19",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "1",
"frame.time": "May 19, 1999 17:49:40.951473000 PDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161380.951473000",
"frame.time_delta": "0.000092000",
"frame.time_delta_displayed": "0.000092000",
"frame.time_relative": "61.242956000",
"frame.number": "131",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.file_off": "12088",
"frame.protocols": "eth:ethertype:arp"
},
"eth": {
"eth.dst": "ff:ff:ff:ff:ff:ff",
"eth.dst_tree": {
"eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215",
"eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast",
"eth.addr.oui": "16777215",
"eth.dst.lg": "1",
"eth.lg": "1",
"eth.dst.ig": "1",
"eth.ig": "1"
},
"eth.src": "00:ab:cd:ef:01:23",
"eth.src_tree": {
"eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426",
"eth.src.oui_resolved": "Example Networks",
"eth.addr": "00:ab:cd:ef:01:23",
"eth.addr_resolved": "Example_ef:01:23",
"eth.addr.oui": "57426",
"eth.addr.oui_resolved": "Example Networks",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000806",
"eth.trailer":
"52:ee:29:10:00:01:00:00:00:00:00:00:00:00:00:00:00:00",
"eth.trailer_tree": {
"_ws.expert": {
"eth.padding_bad": "",
"_ws.expert.message": "Didn't find padding of zeros, and an
undecoded trailer exists. There may be padding of non-zeros.",
"_ws.expert.severity": "4194304",
"_ws.expert.group": "150994944"
}
}
},
"arp": {
"arp.hw.type": "1",
"arp.proto.type": "0x00000800",
"arp.hw.size": "6",
"arp.proto.size": "4",
"arp.opcode": "1",
"arp.src.hw_mac": "00:ab:cd:ef:01:23",
"arp.src.proto_ipv4": "192.168.4.1",
"arp.dst.hw_mac": "00:00:00:00:00:00",
"arp.dst.proto_ipv4": "192.168.4.255"
}
}
}
}
]
and "ek", which looks like:
{"index":{"_index":"packets-1999-05-19","_type":"doc"}}
{"timestamp":"927161319708","layers":{"frame":{"frame_frame_encap_type":"1","frame_frame_time":"1999-05-20T00:48:39.708517000Z","frame_frame_offset_shift":"0.000000000","frame_frame_time_epoch":"927161319.708517000","frame_frame_time_delta":"0.000000000","frame_frame_time_delta_displayed":"0.000000000","frame_frame_time_relative":"0.000000000","frame_frame_number":"1","frame_frame_len":"60","frame_frame_cap_len":"60","frame_frame_marked":false,"frame_frame_ignored":false,"frame_frame_file_off":"24","frame_frame_protocols":"eth:ethertype:arp"},"eth":{"eth_eth_dst":"ff:ff:ff:ff:ff:ff","eth_eth_dst_resolved":"Broadcast","eth_eth_dst_oui":"16777215","eth_eth_addr":"ff:ff:ff:ff:ff:ff","eth_eth_addr_resolved":"Broadcast","eth_eth_addr_oui":"16777215","eth_eth_dst_lg":true,"eth_eth_lg":true,"eth_eth_dst_ig":true,"eth_eth_ig":true,"eth_eth_src":"00:ab:cd:ef:01:23","eth_eth_src_resolved":"Example_ef:01:23","eth_eth_src_oui":"57426","eth_eth_src_oui_resolved":"Example
Networks","eth_eth_addr":"00:ab:cd:ef:01:23","eth_eth_addr_resolved":"Example_ef:01:23","eth_eth_addr_oui":"57426","eth_eth_addr_oui_resolved":"Example
Networks","eth_eth_src_lg":false,"eth_eth_lg":false,"eth_eth_src_ig":false,"eth_eth_ig":false,"eth_eth_type":"0x00000806","eth_eth_padding":"00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"},"arp":{"arp_arp_hw_type":"1","arp_arp_proto_type":"0x00000800","arp_arp_hw_size":"6","arp_arp_proto_size":"4","arp_arp_opcode":"1","arp_arp_src_hw_mac":"00:ab:cd:ef:01:23","arp_arp_src_proto_ipv4":"192.168.4.1","arp_arp_dst_hw_mac":"00:00:00:00:00:00","arp_arp_dst_proto_ipv4":"192.168.4.255"}}}
...
{"index":{"_index":"packets-1999-05-19","_type":"doc"}}
{"timestamp":"927161380951","layers":{"frame":{"frame_frame_encap_type":"1","frame_frame_time":"1999-05-20T00:49:40.951473000Z","frame_frame_offset_shift":"0.000000000","frame_frame_time_epoch":"927161380.951473000","frame_frame_time_delta":"0.000092000","frame_frame_time_delta_displayed":"0.000092000","frame_frame_time_relative":"61.242956000","frame_frame_number":"131","frame_frame_len":"60","frame_frame_cap_len":"60","frame_frame_marked":false,"frame_frame_ignored":false,"frame_frame_file_off":"12088","frame_frame_protocols":"eth:ethertype:arp"},"eth":{"eth_eth_dst":"ff:ff:ff:ff:ff:ff","eth_eth_dst_resolved":"Broadcast","eth_eth_dst_oui":"16777215","eth_eth_addr":"ff:ff:ff:ff:ff:ff","eth_eth_addr_resolved":"Broadcast","eth_eth_addr_oui":"16777215","eth_eth_dst_lg":true,"eth_eth_lg":true,"eth_eth_dst_ig":true,"eth_eth_ig":true,"eth_eth_src":"00:ab:cd:ef:01:23","eth_eth_src_resolved":"Example_ef:01:23","eth_eth_src_oui":"57426","eth_eth_src_oui_resolved":"Example
Networks","eth_eth_addr":"00:ab:cd:ef:01:23","eth_eth_addr_resolved":"Example_ef:01:23","eth_eth_addr_oui":"57426","eth_eth_addr_oui_resolved":"Example
Networks","eth_eth_src_lg":false,"eth_eth_lg":false,"eth_eth_src_ig":false,"eth_eth_ig":false,"eth_eth_type":"0x00000806","eth_eth_trailer":"52:ee:29:10:00:01:00:00:00:00:00:00:00:00:00:00:00:00","_ws_expert":{"eth_eth_padding_bad":null,"_ws_expert__ws_expert_message":"Didn't
find padding of zeros, and an undecoded trailer exists. There may be padding of
non-zeros.","_ws_expert__ws_expert_severity":"4194304","_ws_expert__ws_expert_group":"150994944"}},"arp":{"arp_arp_hw_type":"1","arp_arp_proto_type":"0x00000800","arp_arp_hw_size":"6","arp_arp_proto_size":"4","arp_arp_opcode":"1","arp_arp_src_hw_mac":"00:ab:cd:ef:01:23","arp_arp_src_proto_ipv4":"192.168.4.1","arp_arp_dst_hw_mac":"00:00:00:00:00:00","arp_arp_dst_proto_ipv4":"192.168.4.255"}}}
Both of them have the index.
For each packet, ek puts the index on one line and all the packet fields,
combined, on the next line. It does not treat the entire capture as a JSON
array (no square brackets wrapping the output).
For each packet, json puts each member with a non-object and, I presume,
non-array value on a line by itself, with the opening and closing square
brackets of arrays on lines separate from any of the lines of the array
elements, and with the opening and closing curly brackets of objects on lines
separate from the lines of the object members (but, if the array or object is
an element in a member, the opening bracket is, apparently, on the same line as
the key).
The NDJSON spec is, err, umm, a bit vague; "Each Line is a Valid JSON Value"
doesn't say much, given that they then say "The most common values will be
objects or arrays", which would seem to indicate that a format that puts a
composite value (object or array) on a single line, and a format that puts each
element with a "primitive" or "scalar" value (non-object, non-array, i.e.
string, number, "true", "false", or "null") on a line by itself.
So both
[
{
"_index": "packets-1999-05-19",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "1",
"frame.time": "May 19, 1999 17:48:39.708517000 PDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161319.708517000",
"frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000",
"frame.time_relative": "0.000000000",
"frame.number": "1",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.file_off": "24",
"frame.protocols": "eth:ethertype:arp"
},
"eth": {
"eth.dst": "ff:ff:ff:ff:ff:ff",
"eth.dst_tree": {
"eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215",
"eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast",
"eth.addr.oui": "16777215",
"eth.dst.lg": "1",
"eth.lg": "1",
"eth.dst.ig": "1",
"eth.ig": "1"
},
"eth.src": "00:ab:cd:ef:01:23",
"eth.src_tree": {
"eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426",
"eth.src.oui_resolved": "Example Networks",
"eth.addr": "00:ab:cd:ef:01:23",
"eth.addr_resolved": "Example_ef:01:23",
"eth.addr.oui": "57426",
"eth.addr.oui_resolved": "Example Networks",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000806",
"eth.padding":
"00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"
},
"arp": {
"arp.hw.type": "1",
"arp.proto.type": "0x00000800",
"arp.hw.size": "6",
"arp.proto.size": "4",
"arp.opcode": "1",
"arp.src.hw_mac": "00:ab:cd:ef:01:23",
"arp.src.proto_ipv4": "192.168.4.1",
"arp.dst.hw_mac": "00:00:00:00:00:00",
"arp.dst.proto_ipv4": "192.168.4.255"
}
}
}
},
...
{
"_index": "packets-1999-05-19",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "1",
"frame.time": "May 19, 1999 17:49:40.951473000 PDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161380.951473000",
"frame.time_delta": "0.000092000",
"frame.time_delta_displayed": "0.000092000",
"frame.time_relative": "61.242956000",
"frame.number": "131",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.file_off": "12088",
"frame.protocols": "eth:ethertype:arp"
},
"eth": {
"eth.dst": "ff:ff:ff:ff:ff:ff",
"eth.dst_tree": {
"eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215",
"eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast",
"eth.addr.oui": "16777215",
"eth.dst.lg": "1",
"eth.lg": "1",
"eth.dst.ig": "1",
"eth.ig": "1"
},
"eth.src": "00:ab:cd:ef:01:23",
"eth.src_tree": {
"eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426",
"eth.src.oui_resolved": "Example Networks",
"eth.addr": "00:ab:cd:ef:01:23",
"eth.addr_resolved": "Example_ef:01:23",
"eth.addr.oui": "57426",
"eth.addr.oui_resolved": "Example Networks",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000806",
"eth.trailer":
"52:ee:29:10:00:01:00:00:00:00:00:00:00:00:00:00:00:00",
"eth.trailer_tree": {
"_ws.expert": {
"eth.padding_bad": "",
"_ws.expert.message": "Didn't find padding of zeros, and an
undecoded trailer exists. There may be padding of non-zeros.",
"_ws.expert.severity": "4194304",
"_ws.expert.group": "150994944"
}
}
},
"arp": {
"arp.hw.type": "1",
"arp.proto.type": "0x00000800",
"arp.hw.size": "6",
"arp.proto.size": "4",
"arp.opcode": "1",
"arp.src.hw_mac": "00:ab:cd:ef:01:23",
"arp.src.proto_ipv4": "192.168.4.1",
"arp.dst.hw_mac": "00:00:00:00:00:00",
"arp.dst.proto_ipv4": "192.168.4.255"
}
}
}
}
]
and
[
{
"_index": "packets-1999-05-19",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "1",
"frame.time": "May 19, 1999 17:48:39.708517000 PDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161319.708517000",
"frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000",
"frame.time_relative": "0.000000000",
"frame.number": "1",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.file_off": "24",
"frame.protocols": "eth:ethertype:arp"
},
"eth": {
"eth.dst": "ff:ff:ff:ff:ff:ff",
"eth.dst_tree": {
"eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215",
"eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast",
"eth.addr.oui": "16777215",
"eth.dst.lg": "1",
"eth.lg": "1",
"eth.dst.ig": "1",
"eth.ig": "1"
},
"eth.src": "00:ab:cd:ef:01:23",
"eth.src_tree": {
"eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426",
"eth.src.oui_resolved": "Example Networks",
"eth.addr": "00:ab:cd:ef:01:23",
"eth.addr_resolved": "Example_ef:01:23",
"eth.addr.oui": "57426",
"eth.addr.oui_resolved": "Example Networks",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000806",
"eth.padding":
"00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"
},
"arp": {
"arp.hw.type": "1",
"arp.proto.type": "0x00000800",
"arp.hw.size": "6",
"arp.proto.size": "4",
"arp.opcode": "1",
"arp.src.hw_mac": "00:ab:cd:ef:01:23",
"arp.src.proto_ipv4": "192.168.4.1",
"arp.dst.hw_mac": "00:00:00:00:00:00",
"arp.dst.proto_ipv4": "192.168.4.255"
}
}
}
},
...
{
"_index": "packets-1999-05-19",
"_type": "doc",
"_score": null,
"_source": {
"layers": {
"frame": {
"frame.encap_type": "1",
"frame.time": "May 19, 1999 17:49:40.951473000 PDT",
"frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161380.951473000",
"frame.time_delta": "0.000092000",
"frame.time_delta_displayed": "0.000092000",
"frame.time_relative": "61.242956000",
"frame.number": "131",
"frame.len": "60",
"frame.cap_len": "60",
"frame.marked": "0",
"frame.ignored": "0",
"frame.file_off": "12088",
"frame.protocols": "eth:ethertype:arp"
},
"eth": {
"eth.dst": "ff:ff:ff:ff:ff:ff",
"eth.dst_tree": {
"eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215",
"eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast",
"eth.addr.oui": "16777215",
"eth.dst.lg": "1",
"eth.lg": "1",
"eth.dst.ig": "1",
"eth.ig": "1"
},
"eth.src": "00:ab:cd:ef:01:23",
"eth.src_tree": {
"eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426",
"eth.src.oui_resolved": "Example Networks",
"eth.addr": "00:ab:cd:ef:01:23",
"eth.addr_resolved": "Example_ef:01:23",
"eth.addr.oui": "57426",
"eth.addr.oui_resolved": "Example Networks",
"eth.src.lg": "0",
"eth.lg": "0",
"eth.src.ig": "0",
"eth.ig": "0"
},
"eth.type": "0x00000806",
"eth.trailer":
"52:ee:29:10:00:01:00:00:00:00:00:00:00:00:00:00:00:00",
"eth.trailer_tree": {
"_ws.expert": {
"eth.padding_bad": "",
"_ws.expert.message": "Didn't find padding of zeros, and an
undecoded trailer exists. There may be padding of non-zeros.",
"_ws.expert.severity": "4194304",
"_ws.expert.group": "150994944"
}
}
},
"arp": {
"arp.hw.type": "1",
"arp.proto.type": "0x00000800",
"arp.hw.size": "6",
"arp.proto.size": "4",
"arp.opcode": "1",
"arp.src.hw_mac": "00:ab:cd:ef:01:23",
"arp.src.proto_ipv4": "192.168.4.1",
"arp.dst.hw_mac": "00:00:00:00:00:00",
"arp.dst.proto_ipv4": "192.168.4.255"
}
}
}
}
]
and
[
{ "_index": "packets-1999-05-19", "_type": "doc", "_score": null, "_source":
{ "layers": { "frame": { "frame.encap_type": "1", "frame.time": "May 19, 1999
17:48:39.708517000 PDT", "frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161319.708517000", "frame.time_delta": "0.000000000",
"frame.time_delta_displayed": "0.000000000", "frame.time_relative":
"0.000000000", "frame.number": "1", "frame.len": "60", "frame.cap_len": "60",
"frame.marked": "0", "frame.ignored": "0", "frame.file_off": "24",
"frame.protocols": "eth:ethertype:arp" }, "eth": { "eth.dst":
"ff:ff:ff:ff:ff:ff", "eth.dst_tree": { "eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215", "eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast", "eth.addr.oui": "16777215", "eth.dst.lg":
"1", "eth.lg": "1", "eth.dst.ig": "1", "eth.ig": "1" }, "eth.src":
"00:ab:cd:ef:01:23", "eth.src_tree": { "eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426", "eth.src.oui_resolved": "Example Networks", "eth.addr":
"00:ab:cd:ef:01:23", "eth.addr_resolved": "Example_ef:01:23", "eth.addr.oui":
"57426", "eth.addr.oui_resolved": "Example Networks", "eth.src.lg": "0",
"eth.lg": "0", "eth.src.ig": "0", "eth.ig": "0" }, "eth.type": "0x00000806",
"eth.padding": "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00" },
"arp": { "arp.hw.type": "1", "arp.proto.type": "0x00000800", "arp.hw.size":
"6", "arp.proto.size": "4", "arp.opcode": "1", "arp.src.hw_mac":
"00:ab:cd:ef:01:23", "arp.src.proto_ipv4": "192.168.4.1", "arp.dst.hw_mac":
"00:00:00:00:00:00", "arp.dst.proto_ipv4": "192.168.4.255" } } } },
...
{ "_index": "packets-1999-05-19", "_type": "doc", "_score": null, "_source":
{ "layers": { "frame": { "frame.encap_type": "1", "frame.time": "May 19, 1999
17:49:40.951473000 PDT", "frame.offset_shift": "0.000000000",
"frame.time_epoch": "927161380.951473000", "frame.time_delta": "0.000092000",
"frame.time_delta_displayed": "0.000092000", "frame.time_relative":
"61.242956000", "frame.number": "131", "frame.len": "60", "frame.cap_len":
"60", "frame.marked": "0", "frame.ignored": "0", "frame.file_off": "12088",
"frame.protocols": "eth:ethertype:arp" }, "eth": { "eth.dst":
"ff:ff:ff:ff:ff:ff", "eth.dst_tree": { "eth.dst_resolved": "Broadcast",
"eth.dst.oui": "16777215", "eth.addr": "ff:ff:ff:ff:ff:ff",
"eth.addr_resolved": "Broadcast", "eth.addr.oui": "16777215", "eth.dst.lg":
"1", "eth.lg": "1", "eth.dst.ig": "1", "eth.ig": "1" }, "eth.src":
"00:ab:cd:ef:01:23", "eth.src_tree": { "eth.src_resolved": "Example_ef:01:23",
"eth.src.oui": "57426", "eth.src.oui_resolved": "Example Networks", "eth.addr":
"00:ab:cd:ef:01:23", "eth.addr_resolved": "Example_ef:01:23", "eth.addr.oui":
"57426", "eth.addr.oui_resolved": "Example Networks", "eth.src.lg": "0",
"eth.lg": "0", "eth.src.ig": "0", "eth.ig": "0" }, "eth.type": "0x00000806",
"eth.trailer": "52:ee:29:10:00:01:00:00:00:00:00:00:00:00:00:00:00:00",
"eth.trailer_tree": { "_ws.expert": { "eth.padding_bad": "",
"_ws.expert.message": "Didn't find padding of zeros, and an undecoded trailer
exists. There may be padding of non-zeros.", "_ws.expert.severity": "4194304",
"_ws.expert.group": "150994944" } } }, "arp": { "arp.hw.type": "1",
"arp.proto.type": "0x00000800", "arp.hw.size": "6", "arp.proto.size": "4",
"arp.opcode": "1", "arp.src.hw_mac": "00:ab:cd:ef:01:23", "arp.src.proto_ipv4":
"192.168.4.1", "arp.dst.hw_mac": "00:00:00:00:00:00", "arp.dst.proto_ipv4":
"192.168.4.255" } } } }
]
would appear to be valid NDJSON (the only difference is that the latter has a
bunch of newlines replaced by spaces).
So it sounds as if you want a format that:
1) doesn't have the indices;
2) represents tha packet data as JSON in some fashion.
What's an example of the format you want? Show an example with two packets.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
