mirror of
https://github.com/smittix/intercept.git
synced 2026-07-06 08:38:14 -07:00
08cc2dee92
tshark -G fields lists fields that exist in the protocol tree but aren't all valid for -T fields -e extraction. Changed discovery to actually test candidates by running tshark -T fields -e <field> -r /dev/null and parsing stderr for invalid field names. This correctly identifies which fields work for extraction on the installed version. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>