Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this.

So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a tcp port number; the number of packets sent by the ip addr OR the number of packets received by the ip addr.

What I want to do is that first I let tshark to read from that pcap file, and then use the time range to filter out all the network flows that are in that time range, and then use the ip addr to filter out all the network flows from that ip addr on that already-filter-out-by-time flows, and then use the tcp port number and the number of packets sent/received by the ip addr to finally locate the flow I want. Then follow this flow/stream and save the whole conversation to a new pcap file.

Anyone can help? I'll be very very appreciate it.

share|improve this question

migrated from programmers.stackexchange.com Oct 11 '11 at 20:12

This question came from our site for professional programmers interested in conceptual questions about software development.

Is there a reason you're using tshark instead of wireshark? This sort of stuff is a lot easier to do with the GUI. – Karl Bielefeldt Oct 11 '11 at 19:50

You can use the -r flag to specify the input file, -R to specify the filters and then -w to write the dissected traffic to the output file.

You can get some information over here TShark capture and filter examples

The wireshark-filters manual page has more information about them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.