unable to view gsm_a.dtap.updating_type with tshark

This issue was migrated from bug 11274 in our old bug tracker.

Original bug information:

Reporter: fabio
Status: RESOLVED WORKSFORME
Product: Wireshark
Component: TShark
OS: Windows 8
Platform: x86
Version: 1.12.3

Attachments:

4-Lr-Normal.rf5: Location Updating Request A interface

fabio said:

Build Information:

Version 1.12.3 (v1.12.3-0-gbb3e9a0f from master-1.12)

Unable to view column gsm_a.dtap.updating_type with tshark mode


tshark.exe -Tfields  -e gsm_a.dtap.updating_type -r xxxx.pcap


appears empty while can be appended with Wireshark GUI

added clitshark oswindows version1.12 labels

Pascal Quantin said:

Could you please attach a sample pcap demonstrating the issue? I cannot reproduce it on my side using Wireshark 1.12.5 and the sample capture https://wiki.wireshark.org/SampleCaptures?action=AttachFile&‍do=get&‍target=abis-accept-network.pcap

Pascal Quantin said:

Hi Fabio,

Any news?

fabio said:

Created attachment 13692 Location Updating Request A interface

Pascal Quantin said:

(In reply to fabio from comment #‍3)
> Created attachment 13692 [details]
> Location Updating Request A interface

This is a K12 file that is not decoded without configuration. Could you please tell us what is your K12 preference setting?

Anders Broman said:

Matching c:\k1205\stacks\gsm2p\gsm2p6_4_a_sms.stk mtp2 c:\k1205\tmp_0\fabrice\gsm2p6_4_msc.stk

seems to do the trick.

Jeff Morriss said:

After applying the K12 configuration described in comment 5 it works for me too.

Note that in this particular capture file there's only one frame (frame #1) that contains this field so the tshark command given in comment 0 shows one line with a 0 (the value of that field in that frame) followed by a bunch of empty lines (for all the other frames) but that's to be expected.

Note that you could add a display/read filter to that tshark command line (e.g., add the command line argument "-Y gsm_a.dtap.updating_type") if you don't want to see the blank lines.


I'm going to guess that the blank lines was causing the confusion and close this as WORKSFORME.  Feel free to reopen if that's not the case--please be sure to include the actual output of the tshark command, a screenshot from the GUI, and the corresponding capture file if it's different from the one already attached when reopening.

closed