Just stumbled across:
tshark -T pdml
which is exactly what I need:
<packet>
<proto name="geninfo" pos="0" showname="General information" size="173">
<field name="num" pos="0" show="323" showname="Number" value="143" size="173"/>
<field name="len" pos="0" show="173" showname="Frame Length" value="ad" size="173"/>
<field name="caplen" pos="0" show="173" showname="Captured Length" value="ad" size="173"/>
<field name="timestamp" pos="0" show="Aug 7, 2011 16:16:13.579504000 EST" showname="Captured Time" value="1312697773.579504000" size="173"/>
</proto>
<proto name="frame" showname="Frame 323: 173 bytes on wire (1384 bits), 173 bytes captured (1384 bits)" size="173" pos="0">
<field name="frame.time" showname="Arrival Time: Aug 7, 2011 16:16:13.579504000 EST" size="0" pos="0" show="Aug 7, 2011 16:16:13.579504000"/>
... etc.
It includes the Wireshark filter name, as well as all the fields that are included in the packet.
Update: This is quite slow, and hacking up tshark.c
so -V
prints out the abbrev
instead of the name
in the header_field_info *hfinfo;
does the trick too. I should probably contribute this an a option when I get the chance.