tshark is a terminal (console) based version of Wireshark, a network protocol analyzer for Unix and Windows.
Questions tagged [tshark]
65 questions
0
votes
1 answer
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract Objects > HTTP, and then choosing a file from the HTTP…
Jesss
- 23
- 1
- 4
0
votes
1 answer
How to debug a "connection refused" error with tshark?
I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat.
On machine A, I start a listener:
nc -l -p 4506
On machine B, I fire up the request:
nc -vv …
ivarec
- 151
- 5
0
votes
1 answer
How do I force a date/time format for traffic captured with tshark using "-T fields"?
I'm capturing traffic with tshark into a CSV file using "-T fields", but whatever I try I can't get a nice ISO date or even changing the timezone to UTC.
The command I'm using is
tshark.exe -i 2 -c 1 -T fields -e frame.time
This gives me
Capturing…
lpacheco
- 157
- 2
- 9
0
votes
1 answer
Is the output complete after omitting [TCP segment of reassembled PDU]?
If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in
81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application
Data
83 3.164523000 4.5.6.7 -> 12.13.14.15 TCP 2802 [TCP segment of
a reassembled…
serv-inc
- 167
- 9
0
votes
1 answer
how to determine client side or server side retransmission from a pcap
I am trying to get some clarification on something I read here:
how to calculate packet loss from a binary TCPDUMP file
The first answer says that the sequence number will be the same from client to server and from server to client the ack would be…
user53029
- 629
- 3
- 14
- 36
0
votes
2 answers
Wireshark/tshark cutting data short
We are doing a packet capture from within our testing software using the command line:
tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00""
The problem we have is one of the DHCP options is displayed in hex and cut short. Is…
MikeKulls
- 336
- 1
- 2
- 16
0
votes
1 answer
Extract nth Packet From a Pacp File
Is there any command line tool to extract the n th packet from a pcap file?
I am on CentOS 6.5.
Thanks in advance.
Hei
- 175
- 1
- 1
- 6
0
votes
1 answer
tshark duration of a conversation for a ip address
i can retrieve the follow info from a .pcap :
================================================================================
IPv4 Conversations
Filter:ip.addr==1xx.1xx.0.1xx
| <- | | …
0
votes
1 answer
Tshark read offline file start so slow
I execute tshark (wireshark utility) command that reading from pcap file. Process is too slow. Sometimes take more than 6-7 seconds. Pcap file is really small (~500bytes). Actually strange thing is that re-execute same command consequently, process…
Erdinç Taşkın
- 101
0
votes
1 answer
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the conversation table is printed. For both Linux and Windows,…
Daniel
- 163
- 2
- 11
0
votes
1 answer
tshark/pcap and web-server response time
How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file?
What can you recommend me to do that?
Павел Иванов
- 113
- 1
- 1
- 6
0
votes
1 answer
wireshark windows - how to remote capture/analyze from a tshark or similar install?
I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight.
I see that there is "tshark" which is a command…
Scott Szretter
- 1,882
- 11
- 43
- 66
0
votes
1 answer
Using tshark to generate traffic logs every X seconds
I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable.
This is a linux machine, and without mucking too much into the netstack source (which…
Sridhar Iyer
- 103
- 2
0
votes
2 answers
How to use tshark to do this task
I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this.
So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a tcp port number; the number of packets sent by the…
Tor
- 3
- 3
0
votes
1 answer
How to display ANSI Escape codes e.g. from tshark telnet trace?
How does one display/visualize a trace of a session with ANSI Escape codes embedded in it?
I have a tshark trace of a telnet session to a HP switch. From that, I Follow TCP Stream and get a pseudo-text representation of the telnet session (with…
Peter V. Mørch
- 852
- 7
- 15