The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
15 views

Using TSHARK/Terminal to get unique IP-MACs mapping of all devices in PCAP

I'm trying to get a list of unique IP-MAC mapping from a PCAP file. There are several answers to similar questions but none of them actually meet this exactly. I've tried for example this: tshark -r ...
0
votes
0answers
45 views

Unable to capture DNS requests on server

I am trying to route all DNS queries from my computer through my server. My laptop seems to be sending the queries to the server, but I'm unable to monitor them on the server. On the client (my ...
0
votes
1answer
27 views

How to effectively capture traffic on port 5060 between specific time internals?

users. I want to capture traffic on port 5060 for one week in a file, than wants wireshark to rotate file and start capturing for next week with a different file name. I know little about tshark, ...
0
votes
2answers
679 views

Installing latest wireshark impossible?

It looks like installing a later version of wireshark is near impossible on redhat 6. I've searched the web extensively and can't find any questions where someone has said their issue was resolved. ...
0
votes
0answers
56 views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
4
votes
3answers
700 views

awk filtering live capture with file as pattern list

What I'm trying to do is quite simple. I'm generating output from tshark and redirecting it to awk with a pipe |. Since tshark gets live data, I want that awk search in every output for a pattern ...
2
votes
1answer
2k views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
155 views

tshark command for finding MAC of a specified network

What tshark command could start listening to a specific network and see who (MAC-wise) is connecting to it? I already have the network card in monitor mode at the correct channel. WireShark can ...
3
votes
3answers
998 views

Can't process stdout with pipe as it comes

I'm running tshark on a fifo, and the following is a bare example of a loop that prints the output of tshark as it comes: tshark -i $fifo | while read line; do echo $line done The problem ...