tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.

learn more… | top users | synonyms

1
vote
1answer
36 views

Why do I see so many ssh packets in only a couple seconds?

I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
0
votes
1answer
26 views

Extract nth Packet From a Pacp File

Is there any command line tool to extract the n th packet from a pcap file? I am on CentOS 6.5. Thanks in advance.
1
vote
0answers
39 views

Redirect Default Gateway Traffic in Linux to File

I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
2
votes
0answers
104 views

RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture

I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture. The reason I am not depending on the value in the SDP ...
3
votes
1answer
368 views

How to filter ANY dns requests with tshark

Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record? So far I am able to filter DNS queries with: tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
1
vote
1answer
124 views

Compressing the output of tshark when in multiple files mode

I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
1
vote
0answers
102 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
0
votes
1answer
47 views

Tshark/wireshark on an ephemeral interface

Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently. ...
0
votes
0answers
170 views

Exporting SNMP OID values from wireshark capture?

I am trying to figure out how I can export the SNMP OID values that wireshark picked up. My issue is that when I export the raw data it is all together and not seperated. All I want to to is get only ...
2
votes
1answer
100 views

Any way that I can feed tshark a live capture written to a file without reading from the start?

I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
2
votes
1answer
162 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
1
vote
1answer
187 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
0answers
107 views

error in killing tshark from shell script

I'm getting this error "* glibc detected * /usr/sbin/tshark: double free or corruption " while doing this, any idea why? #!/bin/bash trap 'my_exit; exit' SIGINT SIGQUIT count=0 /usr/sbin/tshark -i ...
0
votes
1answer
84 views

tshark duration of a conversation for a ip address

i can retrieve the follow info from a .pcap : ================================================================================ IPv4 Conversations Filter:ip.addr==1xx.1xx.0.1xx ...
3
votes
2answers
253 views

Reducing a pcap file down to all operations on a specific NFS file

I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle. How can I accomplish this? I know the following facts ...
0
votes
1answer
114 views

Tshark read offline file start so slow

I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
0
votes
1answer
282 views

tshark conversation statistic not resolving hostnames

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
2
votes
2answers
2k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
1
vote
0answers
197 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
0
votes
1answer
167 views

tshark/pcap and web-server response time

How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can ...
2
votes
1answer
765 views

How to make tshark to output valid pcap file used for other max GUI pcap viewer

sudo tshark -i en0 -x -w icmp_sample.pcap This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it Any idea?
3
votes
2answers
1k views

Sniff SSL handshake using tshark

How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem. This needs to be done in tshark, not ...
4
votes
1answer
145 views

Script to find the address udp packets are being sent to?

Here is the scenario. I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables. Is there a way to do it with ...
0
votes
1answer
497 views

wireshark windows - how to remote capture/analyze from a tshark or similar install?

I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight. ...
1
vote
0answers
112 views

How to add TDS support to tshark?

How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark? Currently, the situation is this: root@DEV:/# tshark -d . 2>&1| grep -i tds root@DEV:/# I.e: tshark does not ...
0
votes
1answer
248 views

Using tshark to generate traffic logs every X seconds

I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable. This is a linux machine, and without ...
0
votes
2answers
690 views

How to use tshark to do this task

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this. So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
1
vote
1answer
297 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
5
votes
4answers
2k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
2
votes
2answers
2k views

CLI tool for analyzing pcap captures

I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics. ...
1
vote
1answer
1k views

tshark (wireshark) to pinpoint connect reset / retransmitted issue

Windows server 2003. I have the latest WireShark installed on the server and need to capture packets on the server to pinpoint a randomly happened connection reset /retransmitted issue. When the ...
1
vote
1answer
394 views

tshark (wireshark) filters: Where are they located?

While troubleshooting a MySQL issue, I came across this command at commandlinefu: tshark -i any -T fields -R mysql.query -e mysql.query I am trying to understand it before I actually use it. ...
7
votes
4answers
5k views

Monitor number of bytes transferred to/from IP address on port

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port. The equivalent tcpdump command would be: tcpdump ...
0
votes
1answer
445 views

How to display ANSI Escape codes e.g. from tshark telnet trace?

How does one display/visualize a trace of a session with ANSI Escape codes embedded in it? I have a tshark trace of a telnet session to a HP switch. From that, I Follow TCP Stream and get a ...
0
votes
2answers
255 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
1
vote
1answer
896 views

Checking rtp stream audio quality

We are working in a test environment and need to monitor the audio quality of an rtp stream that is being captured using tshark. Right now we are able to capture the audio and access the file through ...
30
votes
6answers
66k views

Monitoring HTTP traffic using tcpdump

To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...