Skip to main content

Questions tagged [tshark]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
23 views

how to achieve time-shift functionality using tshark?

I want to print captured packets using tshark. However I want to use "time-shift" functionality in tshark (which is readily available in wireshark GUI). I couldn't find any relevant ...
Vijay Gharge's user avatar
0 votes
0 answers
81 views

Load speed difference between Wireshark and tshark

I have some PCAP files from which I'm trying to extract metadata. I am doing this using tshark, opening the file, extracting a couple dozen fields, then writing the table to disk. I've noticed that ...
CopyOfA's user avatar
  • 123
0 votes
0 answers
37 views

mixup TCP sessions in pcap file to new pcap file

I need to shuffle TCP sessions from pcap file to new file. How can I do it? The following scripts don't work for me. To mix up sessions in a pcap file using Tshark or Wireshark, you can use the ...
Mexanizm456's user avatar
0 votes
0 answers
174 views

Why does tshark display "TLSv1" despite curl showing TLSv1.3 in the "Client Hello"?

The output from curl indicates TLSv1.3 (OUT), TLS handshake, Client hello (1). Use --tlsv1.3 to force it to use TLSv1.3: $ curl -6 --tlsv1.3 --tls13-ciphers TLS_AES_256_GCM_SHA384 -vL https://...
林果皞's user avatar
  • 5,176
0 votes
0 answers
90 views

find in tshark/wireshark tcp sessions with unique value in filter - ldap.attributes

I need to find in tshark/wireshark tcp sessions with an unique value in filter - ldap.attributes For example, in a picture In red - value from filter - ldap.attributes. Some filter in the dump can be ...
Mexanizm456's user avatar
0 votes
2 answers
30 views

Pinging two PCs and trying to capture ICMPs with third PC

I have a setup of three computers that are all on the same subnet and connected to a switch. All services are reachable. I'm pinging from PC(1) to PC(2). Opening tshark with PC(3) but cannot see ...
ptiza_v_nebe's user avatar
0 votes
1 answer
108 views

Decoding wireless captures / filters on Linux

I am trying to filter a capture file that was captured by a remote AP. If i pull the file to my laptop i can open in Wireshark decode as peekremote and create the display filter EAPOL to get the ...
DevilWAH's user avatar
  • 111
1 vote
1 answer
110 views

GeoIP not working when processing PCAP with tshark as su

I am working with lots of PCAP files and trying to convert them into .tsv files for tabular analysis. So I'm using tshark in a Ubuntu 22 VirtualBox machine to dissect each packet. I have a bash ...
CopyOfA's user avatar
  • 123
4 votes
2 answers
9k views

System clock not synchronized with NTP server using systemd-timesyncd

I followed this answer here, but it seems that my system clock doesn't synchronize with NTP server: $ cat /etc/debian_version 10.9 $ egrep -v "^$|^#" /etc/systemd/timesyncd.conf [Time] NTP=x....
SebMa's user avatar
  • 2,189
3 votes
1 answer
1k views

Capture DNS traffic to and from a network namespace using tshark

How can I capture traffic specifically from a network interface inside a network namespace using tshark? In my case, the network interface tun0 is moved into the network namespace called vpn. Normally ...
EarthIsHome's user avatar
1 vote
1 answer
361 views

-Y and read {src,dst} port and tshark

tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
PersianGulf's user avatar
1 vote
0 answers
35 views

Unable to capture node-to-node traffic in a wireless access point

I have created a wireless access point on ubuntu and I have written a program that parses network traffic obtained via tshark and condenses it into a readable form. I am able to capture traffic going ...
Abhinav Gupta's user avatar
1 vote
1 answer
294 views

TShark pcap filter command possibly simplified?

Object: to find the IP addresses of HTTP servers in a pcap file with a specific header string. Can or should the -l option to flush be used? One way: the following was done but am wondering if it can ...
stonetwigger's user avatar
4 votes
2 answers
2k views

How to display the interface name with tshark

I am using tshark to diagnose an asymetric route problem. I am filtering the traffic so only src/dest to a specific ip is being captured, but I would like to display a field that shows which interface ...
Bryon's user avatar
  • 339
-1 votes
1 answer
123 views

Can "dumb" ethernet hub device be used for breaking security on Ethernet cable connection? [closed]

Many people will still know about those old ethernet "hub"-devices - also called "dumb" device or "Ethernet signal concentrator". Did anyone ever try to "listen to ANY traffic" on such port through an ...
Dr. Alexander's user avatar
1 vote
1 answer
579 views

How to find min, max data rate of pcap file

I have pcap file and I want to find min and max data rate. I use Capinfos, it shows only average data rate. I would ask how to do that?
Jess Brown's user avatar
0 votes
1 answer
144 views

traffic going through lo interface checking every 4 ports

I have noticed that there' s always traffic going on on my loopback interface. It's not a lot but I don't know where it's coming from and I'd like to stop it. There's syn request going from port X to ...
eftshift0's user avatar
  • 605
0 votes
1 answer
77 views

Repeat Tshark command when first done

I have this command that i need to repeat for ever till i stop it. I have to send a capture to my supplier for VOIP support for a intermitent trouble. But 10mb is taking like five minutes to complete....
Orizon Mobile's user avatar
1 vote
2 answers
185 views

Listen to a folder and modify incoming files on change

I want to convert pcap files to json files using shell script (and tshark). As soon as one or more new pcap files are copied into a folder, the command tshark should be executed and the resulting json ...
mudvayne's user avatar
1 vote
1 answer
2k views

Decode LTE RRC message (hexdump) using Tshark

I have a hexdump of an LTE RRC message that I'm trying to decode using Tshark, and I can't figure out the command line syntax. I'm trying to use the "User DLT" functionality of Wireshark/Tshark to ...
villapx's user avatar
  • 682
-1 votes
1 answer
2k views

Find cipher suites offered by clients in TLS

I have an assignment where I need to extract data from a pcap file. This is what the file looks like: The question is, Find cipher suites offered by clients in TLS. I know that the cipher suites I am ...
DisplayName9's user avatar
8 votes
1 answer
10k views

Find username and password in pcap file

I am completing an assignment where I am given a pcap file to extract data from. The question is, Find username and password in pcap file. This is what I have so far. $ tshark -r assign1.pcap -R '...
DisplayName9's user avatar
4 votes
2 answers
2k views

Find the top 5 (according to number of packets sent) source IP addresses

I am doing an assignment, I'm asked to answer certain questions based on pcap file that I'm given. One of the question is to find the top 5 (according to number of packets sent) source IP addresses. ...
Hashmatullah Noorzai's user avatar
1 vote
1 answer
1k views

Tshark fields for capture filter

I get an invalid capture filter when trying to use this: tshark -i mon0 subtype probe-req -T fields -e wlan.sa -e wlan_mgt.ssid I am trying to limit my results to just the source address and SSID of ...
axxic3's user avatar
  • 157
2 votes
0 answers
148 views

internet access with ping has 100% loss

LAST BREAKTHROUGH -> see the tshark results below for some clue Hi, at home I have the following setup: Internet - NAS (Ubuntu 16.04.4 LTS) - LAN (Asus N56U WiFi) - family users. NAS connects ...
Adrian's user avatar
  • 701
0 votes
1 answer
1k views

tshark filters in Centos 7

I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
chandu's user avatar
  • 191
5 votes
1 answer
16k views

How to filter DNS queries by dns.qry.name in tshark?

This will print the host names of DNS queries: tshark -n -T fields -e dns.qry.name src port 53 How can I filter by the value of dns.qry.name (or get some reasonable proxy of that)? I've tried ...
l0b0's user avatar
  • 51.7k
0 votes
1 answer
4k views

How do I view VLAN tagged packets with any ID?

I'm trying to sniff with tshark on debian and I want to see all the traffic, but I'm missing the VLAN traffic. I can manually configure the interface to add VLAN 10 to eth0 interface and then query ...
A. Rao's user avatar
  • 1
2 votes
1 answer
2k views

Redirecting output of running process via SSH in background

Here is my general question: How do you log into a remote server, kick off a continuously running process, redirect the standard output of that process to a file on the local machine, and have all of ...
igal's user avatar
  • 9,986
1 vote
2 answers
2k views

a script for repeating a tshark command and each minute changing the output file name

I'm bit new to Unix and wanted to ask for quick code I can use to repeat tshark command each 60 sec, the command I want to run is something like: tshark -z io,stat,1,tcp.port==80,tcp.port==443 -a ...
Hossam Zalabany's user avatar
2 votes
0 answers
1k views

How to filter pcap files using tshark

I have to extract data transfered (download, upload) for some specific sites using tshark. Let say, I want to find data downloaded from www.google.com. What fields should I specify in tshark fields ...
Hafiz Muhammad Shafiq's user avatar
1 vote
1 answer
3k views

How to follow tcp streams continuously along the capture with tshark / wireshark?

I display the TCP stream of an already finished capture written in out.pcap with END=$(tshark -r out.pcap -T fields -e tcp.stream | sort -n | tail -1); for ((i=0;i<=END;i++)); do echo $i; tshark ...
user207114's user avatar
1 vote
0 answers
103 views

How to open a changing file with wireshark?

Given a pcap file that is being created in the background, e.g tshark -w out.pcap > /dev/null & How can I open the changing file with wireshark wireshark -r out.pcap Does nont work
wqh29974.dsiay.com's user avatar
4 votes
2 answers
484 views

How to gradually encrypt the tshark output file along the capture?

In order to secure a packet capture, which method would you use to make all (or close to all) past captured packet utterly unaccessible unless a given password is given. My habbits are to mount an ...
user196279's user avatar
1 vote
2 answers
496 views

How to use a greped url provided by tshark inside a bash script?

I'm trying to use a url piped from tshark into a while loop. while read line ; do echo "$line" ffmpeg -i "$line" -c copy "filename" done < <(tshark -i tun0 -B 50 -P -V -q -l -Y 'http matches "(...
dédé's user avatar
  • 13
0 votes
1 answer
198 views

How to effectively capture traffic on port 5060 between specific time internals?

users. I want to capture traffic on port 5060 for one week in a file, than wants wireshark to rotate file and start capturing for next week with a different file name. I know little about tshark, ...
user3310052's user avatar
3 votes
4 answers
8k views

Installing latest wireshark impossible?

It looks like installing a later version of wireshark is near impossible on redhat 6. I've searched the web extensively and can't find any questions where someone has said their issue was resolved. ...
MikeKulls's user avatar
  • 164
1 vote
1 answer
2k views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
user53029's user avatar
  • 2,843
4 votes
3 answers
2k views

awk filtering live capture with file as pattern list

What I'm trying to do is quite simple. I'm generating output from tshark and redirecting it to awk with a pipe |. Since tshark gets live data, I want that awk search in every output for a pattern (...
DMurta's user avatar
  • 143
3 votes
1 answer
4k views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
rokpoto.com's user avatar
1 vote
1 answer
3k views

tshark command for finding MAC of a specified network

What tshark command could start listening to a specific network and see who (MAC-wise) is connecting to it? I already have the network card in monitor mode at the correct channel. WireShark can ...
jenold conele's user avatar
4 votes
3 answers
3k views

Can't process stdout with pipe as it comes

I'm running tshark on a fifo, and the following is a bare example of a loop that prints the output of tshark as it comes: tshark -i $fifo | while read line; do echo $line done The problem ...
admirabilis's user avatar
  • 4,732