1

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get:

enter image description here Using:

tshark -x -r Run18.pcapng -f dst 10.53.30.41

Is there a way round this or is there some other tool that could do it - ideally producing the same sort of output (bytes and text)?

Improve this question
1
  • 2
    It very much helps if you copy and paste text into here, rather than an image. Then you can format with {} and it's searchable and copyable by others.
    – jonathanjo
    Nov 7, 2018 at 11:15

1 Answer 1

Reset to default
2

Tshark is actually extremely powerful for filtering, and has two kinds: capture filters wih -f and display filters with -Y

Tshark documentation says:

Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port == 80). The former are much more limited and are used to reduce the size of a raw packet capture. The latter are used to hide some packets from the packet list.

See

Your pcap files already have been captured, which means that you don't use a capture filter on them, you use a display filter.

$ tshark -r TCPD -Y 'ip.dst == 172.30.20.8'
    1   0.000000 172.30.20.122 → 172.30.20.8  ICMP 98 Echo (ping) request  id=0x4292, seq=1/256, ttl=64

Note the quotes to protect the filter from the shell.

Improve this answer
1
  • Thanks for the hint - eventually got it working with this (since I needed it from a capture): tshark -x -r Run18.pcapng "ip.dst == 10.53.30.41"
    – Robbie Dee
    Nov 7, 2018 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.