Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using tshark to dump and appear to have hit some internal limit within tshark.

tshark -r 2-live.pcap -R " and ip.dst_host ==" -T fields > dumped

This should dump the piece data (32Kbyte pieces) as colon separated bytes in hex without leading 0x so for example: 7f:00:ab:cd.... and so on for 32Kbytes.

One piece is written to the stdout per line which I am simply redirecting to a file, but the piece data is truncated somehow to a line length of 65540, where I am expecting 90-100KBytes per line/piece, given the 3 characters-per-byte required by the output format chosen by tshark (7f: == 1 byte)

Running with strace I can see that tshark is writing 4096 bytes and then 61444 for each piece.

I don't know if this is a hard-wired limitation of tshark with regard to outputing fields of a protocol read from a pcap file, or whether my Linux configuration is limiting this at a lower-level. I strongly expect it is the former but would welcome advice.

Do I need to patch wireshark/tshark code or is there command-line or configuration option I am missing?

Note: I can successfully dump 32768 KBytes payload data from the GUI wireshark tool so the data is definitely in the pcap file. But I am keen to automate this process and need tshark to give me all the bytes...

share|improve this question
up vote 0 down vote accepted

I'd rather suggest you to write raw packet data to a file with -w tshark switch (which should work fine) and then convert them to your desired format with hexdump -v -e '1/1 "%02x:"' <dump.raw >dump.hex.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.