Questions tagged [tshark]
tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.
60
questions
0
votes
0answers
9 views
How to capture UDP traffic so it can be piped to grep
I'm trying to capture UDP traffic which is being sent as StatsD metrics (on port 8125).
The most simple approach I tried is to run nc -ul 8125 which prints the metrics to the terminal...but they are ...
0
votes
0answers
18 views
tshark through ssh to filter dns
I wanted to ask how can I filter by dns through tshark with inline ssh?
I tried
ssh <device>@<ip> 'sudo tshark -i eth0 -f "dst port 53" -n -T fields -e ip.src -e dns.qry.name'
But ...
0
votes
0answers
40 views
tshark filtering out same vlan traffic from command line
I am looking for help on how I can filter out same VLAN traffic(i.e. src IPs 10.1.1.0/24 and dst IPs 10.1.1.0/24) out of a capture file and output all other traffic to a txt file.
I am using a batch ...
0
votes
1answer
84 views
Run tshark in google cloud with external ( public ) IP
I had tried to run tshark in a centos 7 instance hosted in google cloud platform. When we analyze the captured packets, it is only showing the internal IP of that server.
Is there any way to get the ...
google-cloud-platform
4
votes
1answer
2k views
How to print SSL packet details with tshark?
I collected a brief exchange between an SSL client and server (openssl's s_client and s_server, to be exact), and want to view the ssl portions of the pcap file with tshark. I don't need to decrypt ...
1
vote
1answer
1k views
How can I export more than 1000 http request bodies from a large pcap file?
I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
0
votes
1answer
355 views
How do I generate a source of netflow data for nfcapd?
I am trying to use nfcapd to save netflow files for use by a network analysis tool.
How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
0
votes
1answer
730 views
How to display only the source port with tshark
I can display the source and destination tcp ports with
tshark -T fields -e tcp.port
1111,2222
2222,1111
[...]
How can I display only the source port in order to get
1111
2222
0
votes
0answers
372 views
tshark not resolving hostnames
I'm trying to watch on-line to what external hosts one from my laptops (192.168.1.6) tries to access. It works - but no matter what - tshark is not resolving dest IP to hostname. Here is command I'm ...
0
votes
1answer
404 views
decrypting ssl/tsl packets using tshark/wireshark
I am a novice with networking and unix and trying to debug an issue but I have been able to capture packets using tshark in order to analyze and inspect why clients are receiving 401 errors on initial ...
0
votes
1answer
286 views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
0
votes
1answer
689 views
How to debug a “connection refused” error with tshark?
I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat.
On machine A, I start a listener:
nc -l -p 4506
On machine B, I ...
2
votes
1answer
706 views
Capturing HTTP requests for JMeter Raw Data Source
I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it ...
1
vote
1answer
3k views
How to dump VXLAN/VLAN ID in packet capture? [closed]
Is there anyway to use tcpdump or any other linux tool to know VXLAN ID/VLAN ID while capturing packet on interfaces?
0
votes
1answer
2k views
How do I force a date/time format for traffic captured with tshark using “-T fields”?
I'm capturing traffic with tshark into a CSV file using "-T fields", but whatever I try I can't get a nice ISO date or even changing the timezone to UTC.
The command I'm using is
tshark.exe -i 2 -c ...
1
vote
1answer
890 views
how can i setup tshark to capture full URL uri request ip and time stamp
How can I setup tshark to capture full URL uri request ip and time stamp.
I have tried this:
tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
6
votes
2answers
13k views
How to send captured packets to a different destination?
I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
667 views
How do I export both Packet bytes and Summary line using tshark?
I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported.
Since I have many files to do this with I ...
0
votes
1answer
157 views
Is the output complete after omitting [TCP segment of reassembled PDU]?
If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in
81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application
Data
83 3.164523000 4.5.6.7 -> 12....
2
votes
0answers
89 views
Network sensor for a TCP connection for collecting statistics each second [closed]
I need a Network Sensor capable to gather basic end-to-end statistics (packet loss, jitter and network delay/RTT) of several TCP connections directed to the very same destination (ip-addr:port) on ...
2
votes
1answer
394 views
How to filter for the most common problems with tcpdump/tshark
I am currently using the following command in Linux to get specifics on network problems.
tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"...
0
votes
1answer
2k views
how to determine client side or server side retransmission from a pcap
I am trying to get some clarification on something I read here:
how to calculate packet loss from a binary TCPDUMP file
The first answer says that the sequence number will be the same from client to ...
1
vote
2answers
3k views
How to use tshark or tcpdump to calculate bytes transmitted
I am using this command with tshark:
tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'
This essentially parses the pcap for only connections from the source ip and ...
0
votes
2answers
238 views
Wireshark/tshark cutting data short
We are doing a packet capture from within our testing software using the command line:
tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00""
The problem we have is one of the ...
1
vote
1answer
304 views
Why do I see so many ssh packets in only a couple seconds?
I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
0
votes
1answer
100 views
Extract nth Packet From a Pacp File
Is there any command line tool to extract the n th packet from a pcap file?
I am on CentOS 6.5.
Thanks in advance.
1
vote
0answers
166 views
Redirect Default Gateway Traffic in Linux to File
I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
4
votes
0answers
547 views
RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture
I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture.
The reason I am not depending on the value in the SDP ...
4
votes
1answer
3k views
How to filter ANY dns requests with tshark
Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:
tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
2
votes
2answers
2k views
Compressing the output of tshark when in multiple files mode
I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2
votes
0answers
1k views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
0
votes
1answer
186 views
Tshark/wireshark on an ephemeral interface
Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently.
...
2
votes
1answer
518 views
Any way that I can feed tshark a live capture written to a file without reading from the start?
I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
3
votes
1answer
511 views
How to block own rpcap traffic where tshark is running?
Platform :- Fedora 13 32-bit machine
RemoteMachine$ ./rpcapd -n
ClientMachine$ tshark -w "filename" -i "any interface name"
As soon as capture starts without any capture filter, thousands of ...
1
vote
1answer
600 views
“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI
My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error:
"tshark: There are no interfaces on which a capture can be done"
How to ...
2
votes
0answers
452 views
Error in killing Tshark from shell script
I'm getting this error:
* glibc detected * /usr/sbin/tshark: double free or corruption
While doing as below, any idea why?
#!/bin/bash
trap 'my_exit; exit' SIGINT SIGQUIT
count=0
/usr/sbin/...
0
votes
1answer
366 views
tshark duration of a conversation for a ip address
i can retrieve the follow info from a .pcap :
================================================================================
IPv4 Conversations
Filter:ip.addr==1xx.1xx.0.1xx
...
3
votes
2answers
729 views
Reducing a pcap file down to all operations on a specific NFS file
I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.
How can I accomplish this?
I know the following facts ...
0
votes
1answer
334 views
Tshark read offline file start so slow
I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
0
votes
1answer
884 views
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
4
votes
2answers
11k views
using wireshark/tshark in command line to ignore ssh connections
I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore?
I tried to do something like tshark -f "port !22" but ...
1
vote
1answer
684 views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
0
votes
1answer
719 views
tshark/pcap and web-server response time
How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file?
What can ...
4
votes
1answer
6k views
How to make tshark to output valid pcap file used for other max GUI pcap viewer
sudo tshark -i en0 -x -w icmp_sample.pcap
This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it
Any idea?
7
votes
2answers
6k views
Sniff SSL handshake using tshark
How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem.
This needs to be done in tshark, not ...
4
votes
1answer
191 views
Script to find the address udp packets are being sent to?
Here is the scenario.
I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables.
Is there a way to do it with ...
0
votes
1answer
1k views
wireshark windows - how to remote capture/analyze from a tshark or similar install?
I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight.
...
1
vote
0answers
215 views
How to add TDS support to tshark?
How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark?
Currently, the situation is this:
root@DEV:/# tshark -d . 2>&1| grep -i tds
root@DEV:/#
I.e: tshark does not ...
0
votes
1answer
456 views
Using tshark to generate traffic logs every X seconds
I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable.
This is a linux machine, and without ...
0
votes
2answers
1k views
How to use tshark to do this task
I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this.
So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
