Questions tagged [tshark]

tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.

Filter by
Sorted by
Tagged with
0 votes
0 answers
66 views

Capturing in monitor mode reports 0 packet for tshark

MacOS 13.4.1 I'm trying to capture 802.11 management packets with a real 802.11 headers (not just Ethernet header) with tshark. So trying to use % sudo tshark -i wifi0 -I -L Data link ...
0 votes
0 answers
351 views

Failing to decrypt kerberos AP_REP with wireshark

I'm trying to decrypt kerberos traffic with wireshark for the learning purposes. My process of following: First I retrive keytab for the test user with kadmin kadmin.local: ktadd -k vdzh-fin.keytab ...
1 vote
0 answers
315 views

What is the key file for ssldump?

I search google for a tool to decode https traffic and get the ssldump with examples like: ssldump -k xxx.pem -i eth0 -d host example.com I wonder what the key file xxx.pem is. On the server hosting ...
1 vote
1 answer
2k views

how can i setup tshark to capture full URL uri request ip and time stamp

How can I setup tshark to capture full URL uri request ip and time stamp. I have tried this: tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
2 votes
0 answers
197 views

TShark - Include decrypted tls data in output

I'm trying to read https requests from an application and while I can somewhat make sense of the data using wireshark, I cannot make tshark output the data as I want it. One of the problems I've ...
0 votes
1 answer
1k views

tshark : in a HTTP POST request how get form datas in a pretty output?

I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used. On debian, I installed tshark. All works fine, when I run the ...
1 vote
2 answers
3k views

Display delta timestamp and UDP data payload with tcpdump/tshark

I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format. An example of the desired output would be as follows: % head ...
1 vote
1 answer
2k views

How to capture UDP traffic so it can be piped to grep

I'm trying to capture UDP traffic which is being sent as StatsD metrics (on port 8125). The most simple approach I tried is to run nc -ul 8125 which prints the metrics to the terminal...but they are ...
42 votes
7 answers
115k views

Monitoring HTTP traffic using tcpdump

To monitor HTTP traffic between a server and a web server, I'm currently using tcpdump. This works fine, but I'd like to get rid of some superfluous data in the output (I know about tcpflow and ...
2 votes
0 answers
532 views

Error in killing Tshark from shell script

I'm getting this error: * glibc detected * /usr/sbin/tshark: double free or corruption While doing as below, any idea why? #!/bin/bash trap 'my_exit; exit' SIGINT SIGQUIT count=0 /usr/sbin/...
2 votes
1 answer
964 views

Capturing HTTP requests for JMeter Raw Data Source

I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it ...
3 votes
0 answers
2k views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
0 votes
1 answer
219 views

Run tshark in google cloud with external ( public ) IP

I had tried to run tshark in a centos 7 instance hosted in google cloud platform. When we analyze the captured packets, it is only showing the internal IP of that server. Is there any way to get the ...
7 votes
4 answers
19k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
5 votes
1 answer
6k views

How to print SSL packet details with tshark?

I collected a brief exchange between an SSL client and server (openssl's s_client and s_server, to be exact), and want to view the ssl portions of the pcap file with tshark. I don't need to decrypt ...
3 votes
1 answer
4k views

How can I export more than 1000 http request bodies from a large pcap file?

I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
0 votes
1 answer
683 views

How do I generate a source of netflow data for nfcapd?

I am trying to use nfcapd to save netflow files for use by a network analysis tool. How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
1 vote
1 answer
637 views

Why do I see so many ssh packets in only a couple seconds?

I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
0 votes
1 answer
2k views

How to display only the source port with tshark

I can display the source and destination tcp ports with tshark -T fields -e tcp.port 1111,2222 2222,1111 [...] How can I display only the source port in order to get 1111 2222
1 vote
0 answers
698 views

tshark not resolving hostnames

I'm trying to watch on-line to what external hosts one from my laptops (192.168.1.6) tries to access. It works - but no matter what - tshark is not resolving dest IP to hostname. Here is command I'm ...
0 votes
1 answer
772 views

decrypting ssl/tsl packets using tshark/wireshark

I am a novice with networking and unix and trying to debug an issue but I have been able to capture packets using tshark in order to analyze and inspect why clients are receiving 401 errors on initial ...
0 votes
1 answer
697 views

How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?

Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file. In the Wireshark GUI, I was able to do that by File > Extract ...
0 votes
1 answer
1k views

How to debug a "connection refused" error with tshark?

I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat. On machine A, I start a listener: nc -l -p 4506 On machine B, I ...
3 votes
1 answer
4k views

How to dump VXLAN/VLAN ID in packet capture? [closed]

Is there anyway to use tcpdump or any other linux tool to know VXLAN ID/VLAN ID while capturing packet on interfaces?
0 votes
1 answer
3k views

How do I force a date/time format for traffic captured with tshark using "-T fields"?

I'm capturing traffic with tshark into a CSV file using "-T fields", but whatever I try I can't get a nice ISO date or even changing the timezone to UTC. The command I'm using is tshark.exe -i 2 -c ...
0 votes
1 answer
240 views

Is the output complete after omitting [TCP segment of reassembled PDU]?

If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in 81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application Data 83 3.164523000 4.5.6.7 -> 12....
1 vote
1 answer
857 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
12 votes
2 answers
31k views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1 vote
1 answer
1k views

How do I export both Packet bytes and Summary line using tshark?

I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported. Since I have many files to do this with I ...
5 votes
2 answers
4k views

Compressing the output of tshark when in multiple files mode

I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2 votes
0 answers
113 views

Network sensor for a TCP connection for collecting statistics each second [closed]

I need a Network Sensor capable to gather basic end-to-end statistics (packet loss, jitter and network delay/RTT) of several TCP connections directed to the very same destination (ip-addr:port) on ...
0 votes
1 answer
2k views

how to determine client side or server side retransmission from a pcap

I am trying to get some clarification on something I read here: how to calculate packet loss from a binary TCPDUMP file The first answer says that the sequence number will be the same from client to ...
2 votes
1 answer
779 views

How to filter for the most common problems with tcpdump/tshark

I am currently using the following command in Linux to get specifics on network problems. tshark -r file.pcap -q -z io,stat,1,\ "COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\ "...
1 vote
1 answer
2k views

tshark (wireshark) to pinpoint connect reset / retransmitted issue

Windows server 2003. I have the latest WireShark installed on the server and need to capture packets on the server to pinpoint a randomly happened connection reset /retransmitted issue. When the ...
4 votes
1 answer
9k views

How to make tshark to output valid pcap file used for other max GUI pcap viewer

sudo tshark -i en0 -x -w icmp_sample.pcap This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it Any idea?
2 votes
2 answers
7k views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
0 votes
2 answers
452 views

Wireshark/tshark cutting data short

We are doing a packet capture from within our testing software using the command line: tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00"" The problem we have is one of the ...
0 votes
1 answer
338 views

Extract nth Packet From a Pacp File

Is there any command line tool to extract the n th packet from a pcap file? I am on CentOS 6.5. Thanks in advance.
1 vote
0 answers
182 views

Redirect Default Gateway Traffic in Linux to File

I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
4 votes
0 answers
713 views

RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture

I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture. The reason I am not depending on the value in the SDP ...
5 votes
1 answer
5k views

How to filter ANY dns requests with tshark

Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record? So far I am able to filter DNS queries with: tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
1 vote
1 answer
309 views

Tshark/wireshark on an ephemeral interface

Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently. ...
2 votes
1 answer
578 views

Any way that I can feed tshark a live capture written to a file without reading from the start?

I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
4 votes
1 answer
694 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
1 vote
1 answer
827 views

"tshark: There are no interfaces on which a capture can be done" in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
0 votes
1 answer
654 views

tshark duration of a conversation for a ip address

i can retrieve the follow info from a .pcap : ================================================================================ IPv4 Conversations Filter:ip.addr==1xx.1xx.0.1xx ...
0 votes
1 answer
983 views

tshark/pcap and web-server response time

How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can ...
3 votes
2 answers
1k views

Reducing a pcap file down to all operations on a specific NFS file

I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle. How can I accomplish this? I know the following facts ...
0 votes
1 answer
806 views

Tshark read offline file start so slow

I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
0 votes
1 answer
1k views

tshark conversation statistic not resolving hostnames

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...