Stack Overflow
Stack Overflow

Questions tagged [tshark]

tshark is the command line version of wireshark; a free and open-source packet analyzer.

501 questions
6
votes
1 answer

Continuously feeding pcap files to tshark/wireshark

I have pcap files continuously generated to me. It want to continuously feed them to a "ever-running" tshark/wireshark. Here is what I have tried (OSX) mkfifo tsharkin tail -f -c +0 tsharkin | tshark -l -i - > tsharkout 2>stderr & cat file1.pcap >…
Per Steffensen
  • 613
  • 2
  • 7
  • 19
6
votes
2 answers

Get first and last times from pcap file with Wireshark command line tools (like tshark)

I have a huge collection of PCAP files, some of which have been "touched" since they were captured. This means the system timestamp on the file may not equate to the time of the data capture. Additionally, most of the files are autosaves from…
Trashman
  • 1,424
  • 18
  • 27
6
votes
1 answer

Formatting tshark output

Right now I'm using tshark -i wlan0 -c 10 -T fields -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e udp.srcport -e udp.dstport > test.txt Which is working okay it gives me an output like: 192.168.1.240 198.38.110.157 6 …
Ricky
  • 69
  • 1
  • 2
6
votes
2 answers

How to filter tshark results before to write to file?

I try to calculate GET Request from my server. I use tshark. I run followed command to filter incoming traffic and fetch only GET requests: /usr/sbin/tshark -b filesize:1024000 -b files:1 \ 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) -…
Maxim Shoustin
  • 77,483
  • 27
  • 203
  • 225
6
votes
3 answers

The capture file appears to have been cut short in the middle of a packet - how to prevent this error?

in my application i am open Tshark process and start capturing, when i want to finish to capturing i am kill the Tshark process so sometimes the capture file is corrupted and when i am trying to open this file i received the error the capture file…
user1710944
  • 1,419
  • 4
  • 16
  • 17
5
votes
1 answer

using tshark with timestamp and flags

I am trying to use tshark with a few flags and also get timestamp for each filtered trace. I am using this to filter all the DNS queries in my system. I am not able to get the time stamps along with the filters working. For instance if i try…
gsk308
  • 55
  • 1
  • 5
5
votes
1 answer

How to run a tshark command in the background and exit it using subprocess in python

I would like to do a packet capture using tshark, a command-line flavor of Wireshark, while connecting to a remote host device on telnet. I would like to invoke the function I wrote for capture: def wire_cap(ip1,ip2,op_fold,file_name,duration): #…
skrowten_hermit
  • 437
  • 3
  • 11
  • 28
5
votes
2 answers

How to parse protobuf packets in Wireshark

My goal is to have a plugin/dissector that can parse a protocol based on protobuf (UDP). I found on the web an Auto-generate Wireshark/Ethereal dissector plugins for Protocol Buffer messages:…
B. Nir
  • 109
  • 2
  • 3
  • 12
5
votes
4 answers

Export raw packet bytes in tshark, tcpdump, or similar?

Context: I have a *.pcap file with many WLAN probe requests. My goal is to extract the WLAN management frame of each probe request as raw bytes (that is, no headers and no extra information - only the raw bytes like they were originally…
ctitze
  • 691
  • 2
  • 7
  • 17
5
votes
1 answer

Performance and efficiency comparing between dump tools: tcpdump, tshark, dumpcap

I'm capturing tcp/udp packets through network adapter and trying to analyze the packets to get some statistical indicator such like bandwidth rate or protocol efficiency. Anyway i need to monitor the network traffic on specific link (src, dst, port,…
Martian Puss
  • 710
  • 2
  • 7
  • 16
5
votes
2 answers

Filtering VoIP calls with tshark

I'm analyzing VoIP calls on my network For now i'm using a generated .pcap file, but later i'll be listening for this at real time. I'm using tshark, and i can filter some important data pretty easily from the .pcap (like "source ip address and…
Fred
  • 75
  • 1
  • 1
  • 6
4
votes
4 answers

How to spawn multiple python scripts from a python program?

I want to spawn (fork?) multiple Python scripts from my program (written in Python as well). My problem is that I want to dedicate one terminal to each script, because I'll gather their output using pexpect. I've tried using pexpect, os.execlp, and…
Mehdi Asgari
  • 2,111
  • 3
  • 17
  • 18
4
votes
2 answers

Get full HTTP request description via TShark

I need to get full description of the HTTP requests with TShark sniffer. I mean something like Wireshark's GUI where you can get: raw request data (zipped/unzipped); pretty printed extracted HTTP fields: (Host, Accepted-Encoding, Cookies,…
Shcheklein
  • 5,979
  • 7
  • 44
  • 53
4
votes
1 answer

Run pyshark in background

I'd like to run pyshark in the background so while its running I'll still be able to perform some web actions and capture them. One mandatory condition is that I must be able to parse using tshark because I have some proprietary Wireshark…
someuser
  • 43
  • 4
4
votes
1 answer

How do I capture http response codes using tshark?

I am trying to capture a range of http response codes using wireshark via the terminal aka tshark. My goal is to sniff packets HTTP, TCP/SSL and just check that the response codes never return a range between 300-500. What is the inline command to…
Laser Hawk
  • 1,988
  • 2
  • 23
  • 29
1
2
3
…
33 34