0

I have a small problem with filtering the first 1 second of a Pcap file and export it Via C# command. The command below execute just fine in CMD:

c:\Program Files\Wireshark\tshark.exe -r  10Secfile.pcap -T fields -E separator=, -E quote=d -e wlan_mgt.fixed.timestamp -e radiotap.mactime -e wlan_mgt.ssid -e radiotap.dbm_antsignal -e wlan.fc.type_subtype -R "frame.time_relative <=1.0" >> 1SecFile.txt

But when I try to do the exact same thing in C# like this:

strCmdText = "/C \"c:\\Program Files\\Wireshark\\tshark.exe\" -r 10SecFile.pcap -T fields -E separator=, -E quote=d -e wlan_mgt.fixed.timestamp -e radiotap.mactime -e wlan_mgt.ssid -e radiotap.dbm_antsignal -e wlan.fc.type_subtype -R \"frame.time_relative <=1.0\" >> 1SecFile.txt";
System.Diagnostics.Process process = new System.Diagnostics.Process();
process.StartInfo = new System.Diagnostics.ProcessStartInfo("CMD.exe", strCmdText);
process.Start();
process.WaitForExit();

I get this error: "the system cannot find the file specified command". And I am sure that all the paths to executables are found because the code works as soon as I remove the last filter:

 -R \"frame.time_relative <=1.0\"

I even placed a breakpoint after "strCmdText=" and copied the value of it manually and pasted it into CMD and it works just fine.

I really appreciate if you help me to figure this out.

AmGh
  • 36
  • 4
  • Seems like the extra indirection with `cmd /c` removes the quotes around `"frame.time_relative <=1.0"` which makes the "<=1.0" an input redirection to a "=1.0" file which, of course, doesn't exists. Try getting it right on the command line with `cmd /c`, you probably need to use extra quotes, then "import" the command into your c# program once it's working. – Guntram Blohm Mar 14 '14 at 07:59
  • Thanks @Guntram, that's exactly the problem I have tried using extra quotes around the filter and still gives me the same error. – AmGh Mar 14 '14 at 08:12

1 Answers1

0

First I would like to thank @Guntram Blohm for the small but great tip which gave me the lead to go and search new topics. I found this topic which explained my exact problem

So it's as Simple as adding

/S

Before "/C". I can not believe that everything works perfect now. The edited line is as follow:

cmd /S /C "Rest of your code/Command here"

Thanks a lot!

Community
  • 1
  • 1
AmGh
  • 36
  • 4