I have to extract data transfered (download, upload) for some specific sites using tshark. Let say, I want to find data downloaded from www.google.com. What fields should I specify in tshark fields option. Currently, I am using following command to capture google IP and number of connections.

tshark -r mytest.pcap -T fields -e frame.time -e ip.src -e ip.dst -e dns.qry.name -e dns.resp.addr | grep "google.com"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.