mirror of
https://github.com/smittix/intercept.git
synced 2026-06-15 09:03:38 -07:00
182e1f3239
tshark -G fields lists fields that exist in the protocol tree but aren't all valid for -T fields -e extraction. Changed discovery to actually test candidates by running tshark -T fields -e <field> -r /dev/null and parsing stderr for invalid field names. This correctly identifies which fields work for extraction on the installed version. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>