tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.
3
votes
2answers
48 views
Reducing a pcap file down to all operations on a specific NFS file
I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.
How can I accomplish this?
I know the following facts ...
0
votes
1answer
42 views
Tshark read offline file start so slow
I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
0
votes
1answer
62 views
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
1
vote
2answers
278 views
using wireshark/tshark in command line to ignore ssh connections
I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore?
I tried to do something like tshark -f "port !22" but ...
1
vote
0answers
115 views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
0
votes
0answers
72 views
tshark/pcap and web-server response time
How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file?
What can ...
2
votes
1answer
48 views
How to make tshark to output valid pcap file used for other max GUI pcap viewer
sudo tshark -i en0 -x -w icmp_sample.pcap
This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it
Any idea?
0
votes
1answer
111 views
Count all received packet using Tshark [closed]
i am build application who start capturing via Tshark with command line and i am looking for option to count all the received packets after i am start Tshark process this is my function who start the ...
3
votes
2answers
473 views
Sniff SSL handshake using tshark
How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem.
This needs to be done in tshark, not ...
4
votes
1answer
114 views
Script to find the address udp packets are being sent to?
Here is the scenario.
I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables.
Is there a way to do it with ...
0
votes
1answer
319 views
wireshark windows - how to remote capture/analyze from a tshark or similar install?
I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight.
...
1
vote
0answers
79 views
How to add TDS support to tshark?
How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark?
Currently, the situation is this:
root@DEV:/# tshark -d . 2>&1| grep -i tds
root@DEV:/#
I.e: tshark does not ...
0
votes
1answer
121 views
Using tshark to generate traffic logs every X seconds
I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable.
This is a linux machine, and without ...
0
votes
2answers
530 views
How to use tshark to do this task
I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this.
So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
1
vote
1answer
141 views
How can I display-filter the correspondant response to a specific display-filtered request in wireshark?
I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver.
So my plan is to run a test over night (or even weekend), capture the ...
4
votes
2answers
924 views
Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch
I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
1
vote
2answers
865 views
CLI tool for analyzing pcap captures
I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics.
...
1
vote
1answer
860 views
tshark (wireshark) to pinpoint connect reset / retransmitted issue
Windows server 2003.
I have the latest WireShark installed on the server and need to capture packets on the server to pinpoint a randomly happened connection reset /retransmitted issue. When the ...
1
vote
1answer
285 views
tshark (wireshark) filters: Where are they located?
While troubleshooting a MySQL issue, I came across this command at commandlinefu:
tshark -i any -T fields -R mysql.query -e mysql.query
I am trying to understand it before I actually use it. ...
4
votes
4answers
2k views
Monitor number of bytes transferred to/from IP address on port
Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port.
The equivalent tcpdump command would be:
tcpdump ...
0
votes
1answer
357 views
How to display ANSI Escape codes e.g. from tshark telnet trace?
How does one display/visualize a trace of a session with ANSI Escape codes embedded in it?
I have a tshark trace of a telnet session to a HP switch. From that, I Follow TCP Stream and get a ...
0
votes
2answers
225 views
Identifying VoIP Users
I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis.
My setup is like this:
On my core switch, all traffic going in and out of gigabit1 ...
1
vote
1answer
326 views
Checking rtp stream audio quality
We are working in a test environment and need to monitor the audio quality of an rtp stream that is being captured using tshark.
Right now we are able to capture the audio and access the file through ...
24
votes
6answers
49k views
Monitoring HTTP traffic using tcpdump
To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...
