Questions tagged [tshark]
tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.
65
questions
0
votes
0
answers
65
views
Failing to decrypt kerberos AP_REP with wireshark
I'm trying to decrypt kerberos traffic with wireshark for the learning purposes. My process of following:
First I retrive keytab for the test user with kadmin
kadmin.local: ktadd -k vdzh-fin.keytab ...
- 1
0
votes
0
answers
59
views
Not able to decrypt traffic with tshark and curl
Run tshark in background tshark -i any -w file_name.pcap -f "(port 443 or port 10002)" on server machine
Run curl command on client machine after setting export SSLKEYLOGFILE=...
- 218
1
vote
0
answers
190
views
What is the key file for ssldump?
I search google for a tool to decode https traffic and get the ssldump with examples like:
ssldump -k xxx.pem -i eth0 -d host example.com
I wonder what the key file xxx.pem is. On the server hosting ...
- 83
0
votes
0
answers
13
views
ec2 document traffic from machine
I want to document all inbound and outbount traffic from an ec2 machine. I want all to be kept on a log on the machine (or on an s3 bucket, nevermind...) basiclly I need a log that sniffs all the ...
- 1
2
votes
0
answers
96
views
TShark - Include decrypted tls data in output
I'm trying to read https requests from an application and while I can somewhat make sense of the data using wireshark, I cannot make tshark output the data as I want it. One of the problems I've ...
- 121
0
votes
1
answer
799
views
tshark : in a HTTP POST request how get form datas in a pretty output?
I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used.
On debian, I installed tshark. All works fine, when I run the ...
- 107
1
vote
2
answers
2k
views
Display delta timestamp and UDP data payload with tcpdump/tshark
I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.
An example of the desired output would be as follows:
% head ...
- 124
1
vote
1
answer
1k
views
How to capture UDP traffic so it can be piped to grep
I'm trying to capture UDP traffic which is being sent as StatsD metrics (on port 8125).
The most simple approach I tried is to run nc -ul 8125 which prints the metrics to the terminal...but they are ...
- 113
0
votes
1
answer
182
views
Run tshark in google cloud with external ( public ) IP
I had tried to run tshark in a centos 7 instance hosted in google cloud platform. When we analyze the captured packets, it is only showing the internal IP of that server.
Is there any way to get the ...
google-cloud-platform
5
votes
1
answer
5k
views
How to print SSL packet details with tshark?
I collected a brief exchange between an SSL client and server (openssl's s_client and s_server, to be exact), and want to view the ssl portions of the pcap file with tshark. I don't need to decrypt ...
- 201
3
votes
1
answer
4k
views
How can I export more than 1000 http request bodies from a large pcap file?
I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
- 810
0
votes
1
answer
619
views
How do I generate a source of netflow data for nfcapd?
I am trying to use nfcapd to save netflow files for use by a network analysis tool.
How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
- 351
0
votes
1
answer
2k
views
How to display only the source port with tshark
I can display the source and destination tcp ports with
tshark -T fields -e tcp.port
1111,2222
2222,1111
[...]
How can I display only the source port in order to get
1111
2222
- 543
1
vote
0
answers
607
views
tshark not resolving hostnames
I'm trying to watch on-line to what external hosts one from my laptops (192.168.1.6) tries to access. It works - but no matter what - tshark is not resolving dest IP to hostname. Here is command I'm ...
- 11
0
votes
1
answer
673
views
decrypting ssl/tsl packets using tshark/wireshark
I am a novice with networking and unix and trying to debug an issue but I have been able to capture packets using tshark in order to analyze and inspect why clients are receiving 401 errors on initial ...
0
votes
1
answer
579
views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
- 23
0
votes
1
answer
1k
views
How to debug a "connection refused" error with tshark?
I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat.
On machine A, I start a listener:
nc -l -p 4506
On machine B, I ...
- 151
2
votes
1
answer
898
views
Capturing HTTP requests for JMeter Raw Data Source
I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it ...
- 123
3
votes
1
answer
4k
views
How to dump VXLAN/VLAN ID in packet capture? [closed]
Is there anyway to use tcpdump or any other linux tool to know VXLAN ID/VLAN ID while capturing packet on interfaces?
- 139
0
votes
1
answer
3k
views
How do I force a date/time format for traffic captured with tshark using "-T fields"?
I'm capturing traffic with tshark into a CSV file using "-T fields", but whatever I try I can't get a nice ISO date or even changing the timezone to UTC.
The command I'm using is
tshark.exe -i 2 -c ...
- 157
1
vote
1
answer
2k
views
how can i setup tshark to capture full URL uri request ip and time stamp
How can I setup tshark to capture full URL uri request ip and time stamp.
I have tried this:
tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
11
votes
2
answers
28k
views
How to send captured packets to a different destination?
I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
- 466
1
vote
1
answer
1k
views
How do I export both Packet bytes and Summary line using tshark?
I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported.
Since I have many files to do this with I ...
- 113
0
votes
1
answer
193
views
Is the output complete after omitting [TCP segment of reassembled PDU]?
If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in
81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application
Data
83 3.164523000 4.5.6.7 -> 12....
- 167
2
votes
0
answers
110
views
Network sensor for a TCP connection for collecting statistics each second [closed]
I need a Network Sensor capable to gather basic end-to-end statistics (packet loss, jitter and network delay/RTT) of several TCP connections directed to the very same destination (ip-addr:port) on ...
- 31
2
votes
1
answer
700
views
How to filter for the most common problems with tcpdump/tshark
I am currently using the following command in Linux to get specifics on network problems.
tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"...
- 629
0
votes
1
answer
2k
views
how to determine client side or server side retransmission from a pcap
I am trying to get some clarification on something I read here:
how to calculate packet loss from a binary TCPDUMP file
The first answer says that the sequence number will be the same from client to ...
- 629
2
votes
2
answers
6k
views
How to use tshark or tcpdump to calculate bytes transmitted
I am using this command with tshark:
tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'
This essentially parses the pcap for only connections from the source ip and ...
- 629
0
votes
2
answers
339
views
Wireshark/tshark cutting data short
We are doing a packet capture from within our testing software using the command line:
tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00""
The problem we have is one of the ...
- 336
1
vote
1
answer
578
views
Why do I see so many ssh packets in only a couple seconds?
I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
- 113
0
votes
1
answer
249
views
Extract nth Packet From a Pacp File
Is there any command line tool to extract the n th packet from a pcap file?
I am on CentOS 6.5.
Thanks in advance.
- 175
1
vote
0
answers
179
views
Redirect Default Gateway Traffic in Linux to File
I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
- 119
4
votes
0
answers
661
views
RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture
I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture.
The reason I am not depending on the value in the SDP ...
- 141
5
votes
1
answer
5k
views
How to filter ANY dns requests with tshark
Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:
tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
- 455
5
votes
2
answers
4k
views
Compressing the output of tshark when in multiple files mode
I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2
votes
0
answers
2k
views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
- 355
1
vote
1
answer
284
views
Tshark/wireshark on an ephemeral interface
Our server hosts a VPN. Each connection to the VPN creates a new PPP interface (ppp0, ppp1, etc.) and the connections are ephemeral in the sense that the interface can go up or down intermittently.
...
- 123
2
votes
1
answer
564
views
Any way that I can feed tshark a live capture written to a file without reading from the start?
I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
3
votes
1
answer
662
views
How to block own rpcap traffic where tshark is running?
Platform :- Fedora 13 32-bit machine
RemoteMachine$ ./rpcapd -n
ClientMachine$ tshark -w "filename" -i "any interface name"
As soon as capture starts without any capture filter, thousands of ...
- 131
1
vote
1
answer
809
views
"tshark: There are no interfaces on which a capture can be done" in Amazon Linux AMI
My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error:
"tshark: There are no interfaces on which a capture can be done"
How to ...
- 159
2
votes
0
answers
514
views
Error in killing Tshark from shell script
I'm getting this error:
* glibc detected * /usr/sbin/tshark: double free or corruption
While doing as below, any idea why?
#!/bin/bash
trap 'my_exit; exit' SIGINT SIGQUIT
count=0
/usr/sbin/...
0
votes
1
answer
570
views
tshark duration of a conversation for a ip address
i can retrieve the follow info from a .pcap :
================================================================================
IPv4 Conversations
Filter:ip.addr==1xx.1xx.0.1xx
...
3
votes
2
answers
1k
views
Reducing a pcap file down to all operations on a specific NFS file
I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.
How can I accomplish this?
I know the following facts ...
- 39.1k
0
votes
1
answer
661
views
Tshark read offline file start so slow
I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is ...
- 101
0
votes
1
answer
1k
views
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
- 163
5
votes
2
answers
16k
views
using wireshark/tshark in command line to ignore ssh connections
I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore?
I tried to do something like tshark -f "port !22" but ...
- 6,641
1
vote
1
answer
822
views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
- 317
0
votes
1
answer
926
views
tshark/pcap and web-server response time
How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file?
What can ...
- 113
4
votes
1
answer
8k
views
How to make tshark to output valid pcap file used for other max GUI pcap viewer
sudo tshark -i en0 -x -w icmp_sample.pcap
This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it
Any idea?
- 141
8
votes
2
answers
9k
views
Sniff SSL handshake using tshark
How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem.
This needs to be done in tshark, not ...
- 255