Re^7: filter tcpdump packets

[Anonymous Monk]

Although in this case your post gives enough information to figure out the apparent issue, showing the code you're running generally helps too. See How do I post a question effectively?

Also, what was meant with "the actual tshark output" is the following:

If your code is this:

my @cmd = ('tshark','-r',$PCAPFILE,
    qw# -R tcp.options.mss -T fields -e ip.src -e tcp.srcport
    -e ip.dst -e tcp.dstport -e tcp.options.mss_val #);
open my $ts, '-|', @cmd or die "Error opening pipe: $!";

Then please show the output of the following (replacing $PCAPFILE with the actual filename of course):

## from your command line
$ tshark -r $PCAPFILE -R tcp.options.mss -T fields -e ip.src \
  -e tcp.srcport -e ip.dst -e tcp.dstport -e tcp.options.mss_val

That way we know what the input to Perl looks like.

Although admittedly, in this case, the frame dump actually gave the most important hint as to what's going on (MPLS GRE).