Wireshark · Wireshark-users: Re: [Wireshark-users] decode from a specific frame

[Guy Harris <guy@xxxxxxxxxxxx>]

John huysing wrote:
> If I have a capture file and I know the frame number(s) of the packet I 
> want to inspect.
>
>
> I want to get a detailed packet decode of  that/those packet(s).   Can i 
> do this with tshark.

	tshark -V -r {capture file} -R "frame.number == {frame number}"

will print out the frame in question.  You can do "frame.number == 
{first frame number} or frame.number == {second frame number} or ..." if 
you want multiple frames.