0

If you repeat the same routines again and again it would be practical to export them as an equivalent tshark commandline program.

v217
  • 765
  • 1
  • 6
  • 17
  • Could you please clarify your question" : what do you call "wireshark commands" ??? Setup a display filters? Action such as selecting a TCP packet and then doing a "follow TCP dialog"? ... ? – jbm Mar 09 '16 at 08:53
  • @jbm commands = ui interactions – v217 Mar 09 '16 at 09:03
  • @jbm "Setup a display filters? Action such as selecting a TCP packet and then doing a "follow TCP dialog"?" Exactly Actions that transform the data you are inspecting. For example howto export the ui actions and settings described in https://www.imperialviolet.org/2012/06/25/wireshark.html as tshark shellscript? Is there a wireshark log file? Hopefully this answers your question! – v217 Mar 09 '16 at 09:08
  • OK. Just to be nitpicking: "actions that transform the data you are inspecting". These actions do not **transform** the data you are inspecting in any way, they are transforming _the way they are displayed_, which is quite different (the whole original data is still there). – jbm Mar 09 '16 at 09:22
  • Please do have a look at my edit, it's pretty significant! Basically change from "no" to "yes". – jbm Mar 09 '16 at 13:21

1 Answers1

1

Thanks for the clarification on your question.

And then my answer is:

No, there is no way. tshark is not scriptable / does not have a macro language or such.

What you could do through is pipe its output to a script/program of your own that would to the job, but that's a whole different project.

Very important EDIT:

I was wrong, there is a way of "scripting" wireshark / tshark.

(I've heard of it, but never used it myself, so it did not pop in my head immediately, sorry)

Both wireshark an tshark do have scripting capabilities using the lua language. Not sure this may suit your needs but have a look at:

https://wiki.wireshark.org/Lua

https://wiki.wireshark.org/Lua/Examples

As I understand it, most of the time it's intended to be used as dissector prototyping, but it can go beyond that.

Hope this help.

jbm
  • 3,063
  • 1
  • 16
  • 25