tshark: pull the fields that answer one question

One column per -e

-T fields switches the output from a summary sentence to columns. Each -e names a field. -E header=y prints the names once. -E separator=/t leaves the columns tab-separated, which is the default, and makes the choice visible in the command you paste into the ticket. The man page's own example uses _ws.col.info for the summary text.

Ask one question, then pick the columns that answer it. For the files conversation the question is: did 10.8.0.20 talk to 10.8.0.40 on port 443, and what did each frame claim to be? frame.number, frame.time, the two addresses, the two ports, and _ws.col.info are enough. Leave the TLS payload alone.

tshark -r /lab/evidence.pcap -Y 'ip.addr==10.8.0.20 && ip.addr==10.8.0.40 && tcp.port==443' -T fields -E header=y -E separator=/t -e frame.number -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e _ws.col.info

The display filter beside the fields

ip.addr==10.8.0.20 matches either side. Two ip.addr tests combined with && keep the pair. tcp.port==443 matches either port. That is the display-filter spelling of the BPF conversation you used in tcpdump. The quotes are single quotes on the outside so the shell passes the expression through, with double quotes only where a field compares to a string.

A field that does not exist on a frame prints as a blank cell. Blank http.host on a port 443 capture means these frames are not cleartext HTTP. That blank is an answer. It tells you to switch the question to TLS metadata or to the server log, not to add more HTTP columns.

• Display filters use == and &&. BPF uses a word such as host and the word and.
• Put display filters in -Y when the file already exists.
• -f is a capture filter for a live capture. It is BPF, and it does not belong on a pure -r command.
• tcp.flags is a hex mask. _ws.col.info is the readable summary when you want Flags language.

A worked defensive case

The tcpdump note already says the handshake finished and the client sent RST at 10:14:06. The owner asks whether the client was even talking to the files VM. You run the field command for that address pair on port 443. The table shows 10.8.0.20 port 51422 to 10.8.0.40 port 443, times starting at 10:14:01, and info text for SYN, SYN-ACK, data, and RST.

You attach the header and those rows to the ticket, not the pcap dump. The blank HTTP columns you tried first are noted in one line: no cleartext HTTP. The path and the status code have to come from the files VM's log. The capture has done its job.

Where this is documented

tshark(1) documents -T fields, -e, -E, and -Y, and it shows _ws.col as the prefix for columns. Field names are also listed with tshark -G fields, which is a local catalog of the dissectors you have installed.

The info column in the command below is spelled _ws.col.info, matching the manual's example. Filter syntax and field names move between major releases. If a name fails, check -G fields on the version you are running.

Commands

tshark -r /lab/evidence.pcap -Y 'ip.addr==10.8.0.20 && ip.addr==10.8.0.40 && tcp.port==443' -T fields -E header=y -e frame.number -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e _ws.col.info

tshark -G fields | awk -F'\t' '$3 ~ /^(ip|tcp)\./ { print $3 }' | head