tshark is the command line version of wireshark; a free and open-source packet analyzer.
Questions tagged [tshark]
501 questions
21
votes
1 answer
Installing tshark on RHEL
Is there a way to install tshark on RHEL machines using yum install?
when i did: yum install tshark
I got back:
Setting up Install Process
No package tshark available.
Nothing to do
When i did: yum list tshark
I got back:
Loaded plugins:…
Chander Shivdasani
- 9,878
- 20
- 76
- 107
20
votes
1 answer
filtering by domain
I want to filter my pcap file by their domains. I mean, I want to see the packets comes on a website ends with ".com", ".org" or ".net".
I tried:
dns contains "com",
ip.src_host == com,
ip.src_host == com,
http contains "com". None of them worked…
Eray Balkanli
- 7,752
- 11
- 48
- 82
16
votes
1 answer
What are tshark's default output fields?
I'm trying to expand tshark's output. On the first round I haven't found simple solution, only that one can extract a field by the -e option, so the following command outputs
frame number
time from beginning of capture
source ip…
CreMindES
- 323
- 2
- 10
16
votes
1 answer
how to capture package at a specific port on any interface using tshark
I want to capture the package on a specific port on any interface of my machine.
I know how to capture the package on a specific port with a specific interface.
And the command is
tshark -f "udp port 162" -i bond0
And if no interface is…
zhaojing
- 585
- 3
- 11
- 33
15
votes
1 answer
Filter a pcap dump file for a specific time range
Is there any easy way to create a pcap file for the packets related to a specific datetime range maybe using tshark, tcpdump or another commandline tool?
tshark -R with frame.time seems promising but I haven't been able to work that out…
Filippo Vitale
- 7,597
- 3
- 58
- 64
15
votes
4 answers
Understanding [TCP ACKed unseen segment] [TCP Previous segment not captured]
We are doing some load testing on our servers and I'm using tshark to capture some data to a pcap file then using the wireshark GUI to see what errors or warnings are showing up by going to Analyze -> expert Info with my pcap loaded in..
I'm seeing…
Steve
- 390
- 2
- 4
- 16
13
votes
1 answer
tshark outputting all fields?
Is it possible to get tshark output every field (within the packet) using the -T fields option, or similar?
e.g. For every field in the packet/reconstruction, I would like something like…
gak
- 32,061
- 28
- 119
- 154
12
votes
4 answers
How do I use tshark to print request-response pairs from a pcap file?
Given a pcap file, I'm able to extract a lot of information from the reconstructed HTTP request and responses using the neat filters provided by Wireshark. I've also been able to split the pcap file into each TCP stream.
Trouble I'm running into now…
Steven
- 17,796
- 13
- 66
- 118
11
votes
1 answer
Counting TCP retransmission in pyshark
As far as I know pyshark is a Python wrapper to tshark which is the command line version of Wireshark.
Since Wireshark and tshark allow to detect TCP retransmission, I was wondering how I could to that using pyshark. I haven't find any good…
user1315621
- 3,044
- 9
- 42
- 86
11
votes
5 answers
How to use wireshark to capture mysql query sql clearly
Because we develop using remote Mysql server , so cannot check query sql easily, if use local server you can tail - f general_log_file to see which sql are executed when call some http interface. So I installed a wireshark to capture these query sql…
zhuguowei
- 8,401
- 16
- 70
- 106
11
votes
1 answer
How do I format tshark time to ISO format (yyyy-dd-mm)?
I'm trying to print out various fields from a PCAP containing HTTP traffic. One of the columns should be the timestamp in the ISO 8601 format (YYYY-MM-DD hhmmss).
Also, if anyone has a full list of fields that work under -e, that would be awesome…
malogos
- 185
- 3
- 9
9
votes
2 answers
unknown field "capabilities" in io.k8s.api.core.v1.PodSecurityContext (running tshark in a container/k8s pod)
I have build a docker image containing tshark (its an image I am going to use for doing various manual debugging from a kubernetes pod).
I have deployed a container in kubernetes running that image. But when I access the container and try to run…
u123
- 15,603
- 58
- 186
- 303
9
votes
3 answers
How to install tshark on Docker?
I want to install tshark on ubuntu17.04 on Docker for Mac with Dockerfile.
I am using docker-compose
In apt install tshark, there is a following prompt.
The prompt stopping install despite I typed yes.
How to install tshark in Dockerfile?
Dumpcap…
KiYugadgeter
- 3,796
- 7
- 34
- 74
9
votes
3 answers
Use Tshark to view json data
When I use tshark to decode capfile like this
tshark -V -r test.cap -Y 'http>0'
I got
...
JavaScript Object Notation: application/json
Object
Member Key: "ret"
Number value: 99
Member Key: "message"
…
Tony
- 243
- 2
- 5
- 9
8
votes
1 answer
Accessing 802.11 Wireless Management Frames from Python
From Python on Linux I would like to sniff 802.11 management 'probe-request' frames. This is possible from Scapy like so:
# -*- coding: utf-8 -*-
from scapy.all import *
def proc(p):
if ( p.haslayer(Dot11ProbeReq) ):
…
user1503941
- 446
- 3
- 8