Peter Gordon wrote: > tshark can be used to display fields using the -T option. > If the same field occurs a number of times within a protocol, > only one value ( the last ) gets displayed. > > As far as I can see the error looks like it comes from the > routine proto_tree_write_fields. > > The -T pdml option gives the correct output, but is too voluminous. > > Can anyone help with a fix?
There's at least one bug for that: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3818 It was discussed quite a bit at Sharkfest this year too--there seemed to be quite a bit of interest in finding a way to fix it. (But: as evidenced by the fact that there is so much interest and it hasn't been done yet, it's non-trivial to implement.) ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
