Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the conversation table is printed. For both Linux and Windows, the messages displayed before the conversation table correctly show hostnames, only the conversation table doesn't have them.

Linux:

  • command: tshark -i 1 -N n -f "tcp or udp" -z conv,ip
  • OS: Fedora 17 x86
  • tshark version: 1.6.12
  • Solutions tried:
    1. Ommiting -N
    2. Using -N C

Windows:

  • command: tshark -i 2 -f "tcp or udp" -z conv,ip
  • OS: Windows 7 x64
  • tshark version: 1.8.4
  • Solutions tried:
    1. Ommiting -N
    2. Using -N C
    3. Using -N n causes tshark error out on Ctrl-C: (tshark.exe:9692): CaptureChild-WARNING **: signal_pipe_capquit_to_child: 4 header: error Invalid argument

How do I make tshark -z conv,ip display resolve hostnames?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Having tshark showing resolved hostnames in the conversation statistic does not appear possible.

An alternative is to execute the following commands:

tshark -i 1 -N n -e ip.host -E separator=, -f "tcp or udp" -l > tshark_buffer

sort -u tshark_buffer -o tshark_buffer

Where the first command dumps packet information into a file named tshark_buffer, and the second command eliminates duplicate entries. The packet information is stored in the form host1,host2 on each line. However, the duplicate elimination will not catch entries with the hosts reversed (i.e. host2,host1).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.