Questions tagged [tshark]
tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.
61
questions
0
votes
0
answers
76
views
tshark -T fields : any way to print interpreted values of numeric fields?
T-shark is a powerful command-line sibling of Wireshark, the packet capture tool.
At the basic verbosity level, you get one text row per packet, with just some basic information. Example:
tshark -n -i ...
- 241
0
votes
1
answer
356
views
tshark : in a HTTP POST request how get form datas in a pretty output?
I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used.
On debian, I installed tshark. All works fine, when I run the ...
- 107
1
vote
2
answers
1k
views
Display delta timestamp and UDP data payload with tcpdump/tshark
I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.
An example of the desired output would be as follows:
% head ...
- 124
1
vote
1
answer
851
views
How to capture UDP traffic so it can be piped to grep
I'm trying to capture UDP traffic which is being sent as StatsD metrics (on port 8125).
The most simple approach I tried is to run nc -ul 8125 which prints the metrics to the terminal...but they are ...
- 113
0
votes
1
answer
140
views
Run tshark in google cloud with external ( public ) IP
I had tried to run tshark in a centos 7 instance hosted in google cloud platform. When we analyze the captured packets, it is only showing the internal IP of that server.
Is there any way to get the ...
google-cloud-platform
4
votes
1
answer
4k
views
How to print SSL packet details with tshark?
I collected a brief exchange between an SSL client and server (openssl's s_client and s_server, to be exact), and want to view the ssl portions of the pcap file with tshark. I don't need to decrypt ...
- 191
2
votes
1
answer
3k
views
How can I export more than 1000 http request bodies from a large pcap file?
I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
- 770
0
votes
1
answer
508
views
How do I generate a source of netflow data for nfcapd?
I am trying to use nfcapd to save netflow files for use by a network analysis tool.
How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
- 351
0
votes
1
answer
1k
views
How to display only the source port with tshark
I can display the source and destination tcp ports with
tshark -T fields -e tcp.port
1111,2222
2222,1111
[...]
How can I display only the source port in order to get
1111
2222
- 513
1
vote
0
answers
485
views
tshark not resolving hostnames
I'm trying to watch on-line to what external hosts one from my laptops (192.168.1.6) tries to access. It works - but no matter what - tshark is not resolving dest IP to hostname. Here is command I'm ...
- 11
0
votes
1
answer
568
views
decrypting ssl/tsl packets using tshark/wireshark
I am a novice with networking and unix and trying to debug an issue but I have been able to capture packets using tshark in order to analyze and inspect why clients are receiving 401 errors on initial ...
0
votes
1
answer
426
views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
- 23
0
votes
1
answer
1k
views
How to debug a "connection refused" error with tshark?
I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat.
On machine A, I start a listener:
nc -l -p 4506
On machine B, I ...
- 151
2
votes
1
answer
833
views
Capturing HTTP requests for JMeter Raw Data Source
I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it ...
- 123
3
votes
1
answer
4k
views
How to dump VXLAN/VLAN ID in packet capture? [closed]
Is there anyway to use tcpdump or any other linux tool to know VXLAN ID/VLAN ID while capturing packet on interfaces?
- 139
0
votes
1
answer
3k
views
How do I force a date/time format for traffic captured with tshark using "-T fields"?
I'm capturing traffic with tshark into a CSV file using "-T fields", but whatever I try I can't get a nice ISO date or even changing the timezone to UTC.
The command I'm using is
tshark.exe -i 2 -c ...
- 137
1
vote
1
answer
2k
views
how can i setup tshark to capture full URL uri request ip and time stamp
How can I setup tshark to capture full URL uri request ip and time stamp.
I have tried this:
tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
11
votes
2
answers
24k
views
How to send captured packets to a different destination?
I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
- 456
1
vote
1
answer
870
views
How do I export both Packet bytes and Summary line using tshark?
I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported.
Since I have many files to do this with I ...
- 113
0
votes
1
answer
183
views
Is the output complete after omitting [TCP segment of reassembled PDU]?
If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in
81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application
Data
83 3.164523000 4.5.6.7 -> 12....
- 167
2
votes
0
answers
107
views
Network sensor for a TCP connection for collecting statistics each second [closed]
I need a Network Sensor capable to gather basic end-to-end statistics (packet loss, jitter and network delay/RTT) of several TCP connections directed to the very same destination (ip-addr:port) on ...
- 31
2
votes
1
answer
600
views
How to filter for the most common problems with tcpdump/tshark
I am currently using the following command in Linux to get specifics on network problems.
tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"...
- 609
0
votes
1
answer
2k
views
how to determine client side or server side retransmission from a pcap
I am trying to get some clarification on something I read here:
how to calculate packet loss from a binary TCPDUMP file
The first answer says that the sequence number will be the same from client to ...
- 609
2
votes
2
answers
6k
views
How to use tshark or tcpdump to calculate bytes transmitted
I am using this command with tshark:
tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'
This essentially parses the pcap for only connections from the source ip and ...
- 609
0
votes
2
answers
295
views
Wireshark/tshark cutting data short
We are doing a packet capture from within our testing software using the command line:
tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00""
The problem we have is one of the ...
- 287
1
vote
1
answer
501
views
Why do I see so many ssh packets in only a couple seconds?
I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
- 113
0
votes
1
answer
156
views
Extract nth Packet From a Pacp File
Is there any command line tool to extract the n th packet from a pcap file?
I am on CentOS 6.5.
Thanks in advance.
- 165
1
vote
0
answers
177
views
Redirect Default Gateway Traffic in Linux to File
I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
- 119
4
votes
0
answers
616
views
RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture
I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture.
The reason I am not depending on the value in the SDP ...
- 141
5
votes
1
answer
4k
views
How to filter ANY dns requests with tshark
Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:
tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
- 455
4
votes
2
answers
4k
views
Compressing the output of tshark when in multiple files mode
I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2
votes
0
answers
2k
views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
- 345
1
vote
1
answer
271
views
Tshark/wireshark on an ephemeral interface
Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently.
...
- 123
2
votes
1
answer
544
views
Any way that I can feed tshark a live capture written to a file without reading from the start?
I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
3
votes
1
answer
634
views
How to block own rpcap traffic where tshark is running?
Platform :- Fedora 13 32-bit machine
RemoteMachine$ ./rpcapd -n
ClientMachine$ tshark -w "filename" -i "any interface name"
As soon as capture starts without any capture filter, thousands of ...
- 131
1
vote
1
answer
763
views
"tshark: There are no interfaces on which a capture can be done" in Amazon Linux AMI
My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error:
"tshark: There are no interfaces on which a capture can be done"
How to ...
- 149
2
votes
0
answers
490
views
Error in killing Tshark from shell script
I'm getting this error:
* glibc detected * /usr/sbin/tshark: double free or corruption
While doing as below, any idea why?
#!/bin/bash
trap 'my_exit; exit' SIGINT SIGQUIT
count=0
/usr/sbin/...
0
votes
1
answer
477
views
tshark duration of a conversation for a ip address
i can retrieve the follow info from a .pcap :
================================================================================
IPv4 Conversations
Filter:ip.addr==1xx.1xx.0.1xx
...
3
votes
2
answers
939
views
Reducing a pcap file down to all operations on a specific NFS file
I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.
How can I accomplish this?
I know the following facts ...
- 38.6k
0
votes
1
answer
535
views
Tshark read offline file start so slow
I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
- 101
0
votes
1
answer
1k
views
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
- 163
4
votes
2
answers
15k
views
using wireshark/tshark in command line to ignore ssh connections
I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore?
I tried to do something like tshark -f "port !22" but ...
- 6,531
1
vote
1
answer
786
views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
- 307
0
votes
1
answer
868
views
tshark/pcap and web-server response time
How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file?
What can ...
- 113
4
votes
1
answer
7k
views
How to make tshark to output valid pcap file used for other max GUI pcap viewer
sudo tshark -i en0 -x -w icmp_sample.pcap
This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it
Any idea?
- 141
8
votes
2
answers
8k
views
Sniff SSL handshake using tshark
How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem.
This needs to be done in tshark, not ...
- 245
4
votes
1
answer
203
views
Script to find the address udp packets are being sent to?
Here is the scenario.
I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables.
Is there a way to do it with ...
- 185
0
votes
1
answer
1k
views
wireshark windows - how to remote capture/analyze from a tshark or similar install?
I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight.
...
- 1,860
1
vote
0
answers
231
views
How to add TDS support to tshark?
How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark?
Currently, the situation is this:
root@DEV:/# tshark -d . 2>&1| grep -i tds
root@DEV:/#
I.e: tshark does not ...
- 1,056
0
votes
1
answer
563
views
Using tshark to generate traffic logs every X seconds
I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable.
This is a linux machine, and without ...
- 103