tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.

learn more… | top users | synonyms

0
votes
0answers
4 views

Compressing the output of tshark when in multiple files mode

I'm running tshark on a Raspberry Pi Kali image to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB ...
1
vote
0answers
19 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
5
votes
4answers
1k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
0
votes
1answer
21 views

Tshark/wireshark on an ephemeral interface

Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently. ...
0
votes
0answers
81 views

Exporting SNMP OID values from wireshark capture?

I am trying to figure out how I can export the SNMP OID values that wireshark picked up. My issue is that when I export the raw data it is all together and not seperated. All I want to to is get only ...
2
votes
1answer
51 views

Any way that I can feed tshark a live capture written to a file without reading from the start?

I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
2
votes
1answer
106 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
0
votes
0answers
36 views

Capturing same interface with tshark with same or different capture filters

I am in stuck in a situation where an interface will be captured more than one time. Like :- $ tshark -i rpcap://1.1.1.1/lo -f "ip proto 1" -i rpcap://1.1.1.1/lo -f "ip proto 132" or (same filter) ...
1
vote
0answers
72 views

error in killing tshark from shell script

I'm getting this error "* glibc detected * /usr/sbin/tshark: double free or corruption " while doing this, any idea why? #!/bin/bash trap 'my_exit; exit' SIGINT SIGQUIT count=0 /usr/sbin/tshark -i ...
1
vote
1answer
80 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
0
votes
1answer
69 views

tshark duration of a conversation for a ip address

i can retrieve the follow info from a .pcap : ================================================================================ IPv4 Conversations Filter:ip.addr==1xx.1xx.0.1xx ...
0
votes
1answer
131 views

tshark/pcap and web-server response time

How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can ...
3
votes
2answers
215 views

Reducing a pcap file down to all operations on a specific NFS file

I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle. How can I accomplish this? I know the following facts ...
2
votes
1answer
254 views

How to make tshark to output valid pcap file used for other max GUI pcap viewer

sudo tshark -i en0 -x -w icmp_sample.pcap This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it Any idea?
0
votes
1answer
88 views

Tshark read offline file start so slow

I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
0
votes
1answer
196 views

tshark conversation statistic not resolving hostnames

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
1
vote
0answers
103 views

How to add TDS support to tshark?

How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark? Currently, the situation is this: root@DEV:/# tshark -d . 2>&1| grep -i tds root@DEV:/# I.e: tshark does not ...
2
votes
2answers
1k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
1
vote
0answers
166 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
3
votes
2answers
906 views

Sniff SSL handshake using tshark

How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem. This needs to be done in tshark, not ...
4
votes
1answer
139 views

Script to find the address udp packets are being sent to?

Here is the scenario. I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables. Is there a way to do it with ...
0
votes
1answer
415 views

wireshark windows - how to remote capture/analyze from a tshark or similar install?

I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight. ...
29
votes
6answers
61k views

Monitoring HTTP traffic using tcpdump

To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...
0
votes
2answers
246 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
1
vote
1answer
731 views

Checking rtp stream audio quality

We are working in a test environment and need to monitor the audio quality of an rtp stream that is being captured using tshark. Right now we are able to capture the audio and access the file through ...
1
vote
2answers
1k views

CLI tool for analyzing pcap captures

I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics. ...
6
votes
4answers
4k views

Monitor number of bytes transferred to/from IP address on port

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port. The equivalent tcpdump command would be: tcpdump ...
1
vote
1answer
235 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
0
votes
1answer
418 views

How to display ANSI Escape codes e.g. from tshark telnet trace?

How does one display/visualize a trace of a session with ANSI Escape codes embedded in it? I have a tshark trace of a telnet session to a HP switch. From that, I Follow TCP Stream and get a ...
1
vote
1answer
1k views

tshark (wireshark) to pinpoint connect reset / retransmitted issue

Windows server 2003. I have the latest WireShark installed on the server and need to capture packets on the server to pinpoint a randomly happened connection reset /retransmitted issue. When the ...
0
votes
2answers
641 views

How to use tshark to do this task

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this. So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
1
vote
1answer
353 views

tshark (wireshark) filters: Where are they located?

While troubleshooting a MySQL issue, I came across this command at commandlinefu: tshark -i any -T fields -R mysql.query -e mysql.query I am trying to understand it before I actually use it. ...
0
votes
1answer
199 views

Using tshark to generate traffic logs every X seconds

I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable. This is a linux machine, and without ...