title: tshark outputting all fields?
body: <p>Is it possible to get <code>tshark</code> output every field (within the packet) using the <code>-T fields</code> option, or similar?</p>
  
  <p>e.g. For every field in the packet/reconstruction, I would like something like this:</p>
  
  <pre><code>eth.src:f2:3c:91:96:fd:09,ip.src:1.2.3.4,tcp.dst_port:80,http.request.uri:/index.html
  </code></pre>
  
  <p>(The comma could be replaced with a <code>\xff</code> to make parsing better when values contain commas.)</p>
  
  <p>I realise there is the <code>-e</code> option but it seems that I would have to put in every single possible field in the command line. On top of that, only a small fraction of fields will be used in each packet, which makes for a lot of data to parse.</p>
  
  <p>I currently plan to use the <code>tshark -V</code> option and parse that, but ideally I would like more machine style terms such as <code>http.request.uri</code> instead of "human readable" e.g.:</p>
  
  <pre><code>Hypertext Transfer Protocol
      GET /main.php HTTP/1.1\r\n
          [Expert Info (Chat/Sequence): GET /main.php HTTP/1.1\r\n]
              [Message: GET /main.php HTTP/1.1\r\n]
              [Severity level: Chat]
              [Group: Sequence]
          Request Method: GET
          Request URI: /main.php
  </code></pre>