Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics.

To give you a little background, I have the output of a large capture (~3GB, in 40 files) that I can't easily transfer to a machine where I can run Wireshark, given the low bandwidth.

share|improve this question

closed as off-topic by mdpc, HopelessN00b Jan 24 '15 at 2:47

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

could you perhaps run a tshark or tcpdump filter on the files to reduce them to a more transferable size? – Michael Lowman Jan 7 '11 at 13:20
@Michael Lowman, I was already filtering, and they are still large. The link in question I am trying to monitor is a ~300kb/s link. Something was saturating the link, and I was trying to identify it. – Zoredache Jan 7 '11 at 18:09
up vote 4 down vote accepted

To expand on Niall's answer, you might try

tshark -r <capture file> -q -z conv,ip

The -q disables normal output and -z conv,ip dumps the IP conversation data. More information can be found in the man page and in Sake Blok's Sharkfest presentation.

share|improve this answer

There is a command line component to wireshark called tshark which would do what you need. There's better instruction available here.

Unfortunately, endpoints seem to be only available in the GUI.

Another alternative might be to use X Forwarding to run Wireshark at the far side and forward the GUI to your local desktop. Without knowing what OS you're using on your desktop, I don't know how possible this will be.

UPDATE: More detail added as per comment request.

share|improve this answer
That is a good start, but would be useful if you could elaborate so the answer will be more complete? – Zoredache Jan 6 '11 at 19:50
Sorry, threw that up when running out the door yesterday. More detail added. – Niall Donegan Jan 7 '11 at 13:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.