Strip off protocol layers

[sean bzd <seanbzd () gmail com>]

Hi,
I'm using tshark to convert .pcap to .txt format using the -r option and
redirecting the output to a file. eg. tshark -r file.pcap -V>file.txt
The problem is that the size of the txt file is about 30x larger than the
pcap since I'm using the -V(erbose) option. I'm wondering if there is a way
to strip off some of the protocol headers that I'm not interested in. e.g.
I want to strip off the 'Frame', 'Ethernet' and 'IP' protocol layers before
redirecting the output to a txt. Is that possible? Another idea is to
selectively expand (Verbose) only the protocols i'm interested in. Is any
of this possible. If yes, i'd appreciate some advice. Thanks a lot.
Sean.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe