0

I would like to get the processed result by tshark or wireshark and use it in python, which I think the .json format it great. Now I use:

ssh root@ip tcpdump -i eth0 -w - | tshark -i - -Tjson

to get the network packet from a remote system cause the remote system only has tcpdump, no more software can be installed. -w - means output to stdout and -i - mean read from stdin. Now I can see the json output in terminal in realtime but I would like to receive the json object in python and process it. I try write this code in alpha.py:

import sys

for line in sys.stdin:
    print line

and use command below to get the output:

ssh root@ip tcpdump -i eth0 -w - | tshark -i - -Tjson | python3 alpha.py

and the output seems to be like this:

[
  {
    "_index": "packets-2019-04-30",
    "_type": "pcap_file",
    "_score": null,
    "_source": {
      "layers": {
        "frame": {
          "frame.encap_type": "1",
          "frame.time": "Jan  1, 1970 08:14:05.382776000 HKT",
          "frame.offset_shift": "0.000000000",
          "frame.time_epoch": "845.382776000",
          "frame.time_delta": "0.000000000",
          "frame.time_delta_displayed": "0.000000000",
          "frame.time_relative": "0.000000000",
          "frame.number": "1",
          "frame.len": "111",

yeah that's every 'line' is just an output print line, but not a complete json string. By the way the output above did not read from stdin but from .pcap file for convenience:

tshark -r a.pcap -Tjson  | python3 alpha.py

Now I'm confused but many people has offers me with ideas. Now I would like to make it more clear so I post this post. The original post is here:How to forward Wireshark processed data to python? in what kind of method?

and many thanks to @Ente https://stackoverflow.com/users/3215929/ente

I'm looking forward to the solutions. Thanks.

shih alex
  • 71
  • 1
  • 8
  • Use `-Tek` if you want to have one json per line. From the documentation: *"__ek__ Newline delimited JSON format for bulk import into Elasticsearch"*. – Steffen Ullrich Apr 30 '19 at 00:19
  • When use ```-Tek``` one packet can be decode into 2 json format, one is ```{"index" : {"_index": "packets-2019-04-30", "_type": "pcap_file"}}``` and the other is start with ```{"timestamp" : "1556587637021",```, no matter read from .pcap file or read from network interface such as ```eth0``` – shih alex Apr 30 '19 at 01:29
  • And your problem is exactly what with this line based format you get? Why can't you simply ignore the JSON lines which have no value to you? – Steffen Ullrich Apr 30 '19 at 02:05
  • You are welcome. I can't install `pyshark` right now but have you tried `pyshark.FileCapture('-')` ? As far as I can see you would need to drop the tshark step then as well. So something along those lines: `ssh root@ip tcpdump -i eth0 -w - | python -c "import pyshark; pyshark.FileCapture('-')"` – Ente May 03 '19 at 15:14
  • Also make sure that you don't `ssh` to that machine using the same interface you are sniffing from. Otherwise you will produce an endless sniff-decode loop which will blow up your machine eventually ;) – Ente May 03 '19 at 15:18

0 Answers0