0

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the conversation table is printed. For both Linux and Windows, the messages displayed before the conversation table correctly show hostnames, only the conversation table doesn't have them.

Linux:

  • command: tshark -i 1 -N n -f "tcp or udp" -z conv,ip
  • OS: Fedora 17 x86
  • tshark version: 1.6.12
  • Solutions tried:
    1. Ommiting -N
    2. Using -N C

Windows:

  • command: tshark -i 2 -f "tcp or udp" -z conv,ip
  • OS: Windows 7 x64
  • tshark version: 1.8.4
  • Solutions tried:
    1. Ommiting -N
    2. Using -N C
    3. Using -N n causes tshark error out on Ctrl-C: (tshark.exe:9692): CaptureChild-WARNING **: signal_pipe_capquit_to_child: 4 header: error Invalid argument

How do I make tshark -z conv,ip display resolve hostnames?

0

Having tshark showing resolved hostnames in the conversation statistic does not appear possible.

An alternative is to execute the following commands:

tshark -i 1 -N n -e ip.host -E separator=, -f "tcp or udp" -l > tshark_buffer

sort -u tshark_buffer -o tshark_buffer

Where the first command dumps packet information into a file named tshark_buffer, and the second command eliminates duplicate entries. The packet information is stored in the form host1,host2 on each line. However, the duplicate elimination will not catch entries with the hosts reversed (i.e. host2,host1).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.