Questions tagged [tshark]
tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.
63
questions
0
votes
0answers
9 views
dumpcap filter size, and maybe taken from file?
When running `dumpcap -i any -f "host 1.2.3.4 or host 2.3.4.5..." -w file.pcap
how big can the filter be, and is it possible to use a file for filter as input, if I want to capture from let'...
0
votes
1answer
55 views
tshark : in a HTTP POST request how get form datas in a pretty output?
I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used.
On debian, I installed tshark. All works fine, when I run the ...
0
votes
0answers
47 views
Long running tshark, not dumpcap, because of JSON output
I need the tshark feature for outputting in JSON, but also need to do long/forever runs.
tshark seems to eat up memory slowly, whereas dumpcap doesn't.
I would like to avoid having to split up files ...
0
votes
0answers
44 views
Complex (nested, etc.) packet filtering from .pcap files using tshark or other tools
A few notes in advance
The task is to read from a captured .pcap file than a live stream.
It shall be performed via the command line than the GUI for potential automation.
I understand that such ...
1
vote
2answers
358 views
Display delta timestamp and UDP data payload with tcpdump/tshark
I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.
An example of the desired output would be as follows:
% head ...
0
votes
1answer
444 views
How to capture UDP traffic so it can be piped to grep
I'm trying to capture UDP traffic which is being sent as StatsD metrics (on port 8125).
The most simple approach I tried is to run nc -ul 8125 which prints the metrics to the terminal...but they are ...
0
votes
1answer
98 views
Run tshark in google cloud with external ( public ) IP
I had tried to run tshark in a centos 7 instance hosted in google cloud platform. When we analyze the captured packets, it is only showing the internal IP of that server.
Is there any way to get the ...
google-cloud-platform
4
votes
1answer
3k views
How to print SSL packet details with tshark?
I collected a brief exchange between an SSL client and server (openssl's s_client and s_server, to be exact), and want to view the ssl portions of the pcap file with tshark. I don't need to decrypt ...
2
votes
1answer
2k views
How can I export more than 1000 http request bodies from a large pcap file?
I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
0
votes
1answer
401 views
How do I generate a source of netflow data for nfcapd?
I am trying to use nfcapd to save netflow files for use by a network analysis tool.
How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
0
votes
1answer
809 views
How to display only the source port with tshark
I can display the source and destination tcp ports with
tshark -T fields -e tcp.port
1111,2222
2222,1111
[...]
How can I display only the source port in order to get
1111
2222
0
votes
0answers
421 views
tshark not resolving hostnames
I'm trying to watch on-line to what external hosts one from my laptops (192.168.1.6) tries to access. It works - but no matter what - tshark is not resolving dest IP to hostname. Here is command I'm ...
0
votes
1answer
475 views
decrypting ssl/tsl packets using tshark/wireshark
I am a novice with networking and unix and trying to debug an issue but I have been able to capture packets using tshark in order to analyze and inspect why clients are receiving 401 errors on initial ...
0
votes
1answer
310 views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
0
votes
1answer
821 views
How to debug a “connection refused” error with tshark?
I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat.
On machine A, I start a listener:
nc -l -p 4506
On machine B, I ...
2
votes
1answer
769 views
Capturing HTTP requests for JMeter Raw Data Source
I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it ...
1
vote
1answer
3k views
How to dump VXLAN/VLAN ID in packet capture? [closed]
Is there anyway to use tcpdump or any other linux tool to know VXLAN ID/VLAN ID while capturing packet on interfaces?
0
votes
1answer
2k views
How do I force a date/time format for traffic captured with tshark using “-T fields”?
I'm capturing traffic with tshark into a CSV file using "-T fields", but whatever I try I can't get a nice ISO date or even changing the timezone to UTC.
The command I'm using is
tshark.exe -i 2 -c ...
1
vote
1answer
1k views
how can i setup tshark to capture full URL uri request ip and time stamp
How can I setup tshark to capture full URL uri request ip and time stamp.
I have tried this:
tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
9
votes
2answers
19k views
How to send captured packets to a different destination?
I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
739 views
How do I export both Packet bytes and Summary line using tshark?
I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported.
Since I have many files to do this with I ...
0
votes
1answer
167 views
Is the output complete after omitting [TCP segment of reassembled PDU]?
If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in
81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application
Data
83 3.164523000 4.5.6.7 -> 12....
2
votes
0answers
95 views
Network sensor for a TCP connection for collecting statistics each second [closed]
I need a Network Sensor capable to gather basic end-to-end statistics (packet loss, jitter and network delay/RTT) of several TCP connections directed to the very same destination (ip-addr:port) on ...
2
votes
1answer
471 views
How to filter for the most common problems with tcpdump/tshark
I am currently using the following command in Linux to get specifics on network problems.
tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"...
0
votes
1answer
2k views
how to determine client side or server side retransmission from a pcap
I am trying to get some clarification on something I read here:
how to calculate packet loss from a binary TCPDUMP file
The first answer says that the sequence number will be the same from client to ...
2
votes
2answers
4k views
How to use tshark or tcpdump to calculate bytes transmitted
I am using this command with tshark:
tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'
This essentially parses the pcap for only connections from the source ip and ...
0
votes
2answers
267 views
Wireshark/tshark cutting data short
We are doing a packet capture from within our testing software using the command line:
tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00""
The problem we have is one of the ...
1
vote
1answer
410 views
Why do I see so many ssh packets in only a couple seconds?
I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
0
votes
1answer
117 views
Extract nth Packet From a Pacp File
Is there any command line tool to extract the n th packet from a pcap file?
I am on CentOS 6.5.
Thanks in advance.
1
vote
0answers
171 views
Redirect Default Gateway Traffic in Linux to File
I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
4
votes
0answers
569 views
RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture
I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture.
The reason I am not depending on the value in the SDP ...
4
votes
1answer
3k views
How to filter ANY dns requests with tshark
Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:
tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
4
votes
2answers
3k views
Compressing the output of tshark when in multiple files mode
I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2
votes
0answers
1k views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
0
votes
1answer
232 views
Tshark/wireshark on an ephemeral interface
Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently.
...
2
votes
1answer
528 views
Any way that I can feed tshark a live capture written to a file without reading from the start?
I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
3
votes
1answer
568 views
How to block own rpcap traffic where tshark is running?
Platform :- Fedora 13 32-bit machine
RemoteMachine$ ./rpcapd -n
ClientMachine$ tshark -w "filename" -i "any interface name"
As soon as capture starts without any capture filter, thousands of ...
1
vote
1answer
654 views
“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI
My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error:
"tshark: There are no interfaces on which a capture can be done"
How to ...
2
votes
0answers
464 views
Error in killing Tshark from shell script
I'm getting this error:
* glibc detected * /usr/sbin/tshark: double free or corruption
While doing as below, any idea why?
#!/bin/bash
trap 'my_exit; exit' SIGINT SIGQUIT
count=0
/usr/sbin/...
0
votes
1answer
396 views
tshark duration of a conversation for a ip address
i can retrieve the follow info from a .pcap :
================================================================================
IPv4 Conversations
Filter:ip.addr==1xx.1xx.0.1xx
...
3
votes
2answers
844 views
Reducing a pcap file down to all operations on a specific NFS file
I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.
How can I accomplish this?
I know the following facts ...
0
votes
1answer
403 views
Tshark read offline file start so slow
I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
0
votes
1answer
920 views
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
4
votes
2answers
13k views
using wireshark/tshark in command line to ignore ssh connections
I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore?
I tried to do something like tshark -f "port !22" but ...
1
vote
1answer
733 views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
0
votes
1answer
770 views
tshark/pcap and web-server response time
How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file?
What can ...
4
votes
1answer
6k views
How to make tshark to output valid pcap file used for other max GUI pcap viewer
sudo tshark -i en0 -x -w icmp_sample.pcap
This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it
Any idea?
8
votes
2answers
7k views
Sniff SSL handshake using tshark
How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem.
This needs to be done in tshark, not ...
4
votes
1answer
195 views
Script to find the address udp packets are being sent to?
Here is the scenario.
I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables.
Is there a way to do it with ...
0
votes
1answer
1k views
wireshark windows - how to remote capture/analyze from a tshark or similar install?
I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight.
...
