I am working on a parsing script for a bunch of regular small pcap files created with tshark.
What I need is to extract the precise (down to milliseconds) timestamp of the first packet in the capture and the last one. I tried "capinfos myfile" but that has a precision down to seconds and for captures lasting less than one second that's not very helpful.
Does anyone know how I can grab that info?
Run capinfos -c to display the number of packets:
$ capinfos -c lmt_04.pcap
File name: lmt_04.pcap
Number of packets: 1645
Run TShark -T fields to print the frame.time of the first and the last packet:
$ tshark -r lmt_04.pcap -R "frame.number==1 || frame.number==1645" -T fields -e frame.time
Aug 28, 2009 21:29:24.491572000
Aug 28, 2009 21:30:36.747868000
Related
I want to convert a pcap file to csv/tsv with "Tshark" where each line corresponds to a packet and have the following format:
timestamp src_ip dst_ip protocol
I use this command:
tshark -r <file_name.pcap> -T fields -e frame.time_epoch -e ip.src -e ip.dst -e ip.proto
However, in the displayed output I see some lines to have two src,dst IP addresses and protocol number like this:
1525794300.3842 92.153.107.1,203.46.108.229 203.46.108.229,85.50.172.78 1,1
While for the rest, each line has one src IP, one dst IP and one protocol like the following:
1525794300.3843 185.61.46.124 163.218.99.213 6
Is there any reason that tshark is displaying multiple src and dst ip addresses in a single line? Can we do something so tshark does not do this?
Thanks!
The reason tshark displays multiple src and dst IP addresses as well as multiple protocol numbers is because there are multiple IP headers in the packet. In this case, it's ICMP packet carrying information about another ICMP packet, perhaps a "Time to live exceeded in transit" or some other such error. If you open the file in Wireshark or run tshark -r <file_name.pcap> -Y "icmp", you will be able to see this for yourself.
If you're only interested in the first (outer) IP src and dst addresses and protocol number, then you can limit the output to the first occurrence of each field as follows:
tshark -r <file_name.pcap> -T fields -E occurrence=f -e frame.time_epoch -e ip.src -e ip.dst -e ip.proto
Alternatively, you can specify columns while limiting the field occurrences this way:
On *nix:
tshark -r <file_name.pcap> -o 'gui.column.format:"Epoch Time","%Cus:frame.time_epoch","Src","%Cus:ip.src:1","Dst","%Cus:ip.dst:1","Proto","%Cus:ip.proto:1"'
On Windows:
tshark.exe -r <file_name.pcap> -o "gui.column.format:\"Epoch Time\",\"%Cus:frame.time_epoch\",\"Src\",\"%Cus:ip.src:1\",\"Dst\",\"%Cus:ip.dst:1\",\"Proto\",\"%Cus:ip.proto:1\""
Run tshark -G column-formats for additional help with the column formats.
I have a captured trace (.pcap) file and I want to read the data field of each captured packet in this trace. I can do this using this command:
tshark -r aa.pcap -Tfields -Y "udp" -e data
3000ca02f89f0004000115af0000017900.......
This command reads all the content in the data field of each packet. My question is that how can I read specific bytes from the data (e.g. the 5th and 6th bytes only)
f89f
If you have cut available on your system, you could pipe the tshark output to it to isolate the characters you desire. For example:
tshark -r aa.pcap -Tfields -Y "udp" -e data | cut -c 9-12
You can even test this as follows:
echo 3000ca02f89f0004000115af0000017900 | cut -c 9-12
f89f
EDIT: I adjusted the offsets from 10-13 to 9-12, as that seems to be the correct offsets. If you quote the characters in the echo command, then you need 10-13, but those aren't the right offsets you need for the tshark output.
I have a pcap of ICMP packets. I am trying to use tshark to extract the payload data so that I can extract a specific byte offset.
The tshark documentation is highly convoluted, especially for me, a beginner.
I've been searching around a lot and I'm trying to piece together a command for the purpose of my goal.
I can run the following command:
shark -r test.pcapng -Y icmp -z flow,icmp,network > output.bin
But it only outputs the packet list as it were shown in Wireshark.
For example, I am trying to extract the following byte offset from each packet (offset 22):
How would I go about extracting a specific byte offset with tshark?
EDIT:
Issuing the following command only returns a portion of the payload data, how can I get all of it?
tshark -r test.pcapng -Y "frame.number == 13" -T fields -e data -w output.bin
I've provided an answer over at https://ask.wireshark.org/question/14795/extract-specific-byte-offset-using-tshark/, but for convenience, I'll summarize the 2 possible solutions I provided here. In a nutshell:
The highlighted byte in the image appears to be the TTL field of the IP header. If that's the field you're interested in, you can obtain it via:
tshark -r test.pcapng -Y "frame.number == 13" -T fields -e ip.ttl -w output.bin
If you're looking for a more general solution to print the 22nd byte of the packet, regardless of whether it's the ip.ttl field or not, then you can use a solution such as:
tshark -r test.pcapng -Y "frame.number == 13" -x -w output.bin | grep "^0010" | cut -d ' ' -f 9
The 2nd solution above also illustrates how you can dump all the bytes; it's done using tshark's -x option.
I have a long running tcpdump that runs over ssh which outputs to a file.
ssh remotehost.example.com -p "tcpdump -i eth0 -w - " > capture-`date '+%Y%m%d-%H%M'`.pcap
How can I rotate that file by day or week? It is important to not duplicate or lose any content.
From the tcpdump man page:
-G If specified, rotates the dump file specified with the -w option every rotate_sec‐
onds seconds. Savefiles will have the name specified by -w which should include a
time format as defined by strftime(3). If no time format is specified, each new
file will overwrite the previous.
If used in conjunction with the -C option, filenames will take the form of
`file<count>'.
For example, if you want to rotate every 10 seconds:
tcpdump -i eth0 -G 10 -w capture-%Y%m%d-%H%M%S.pcap
In your case, you can rotate daily like so:
tcpdump -i eth0 -G 86400 -w capture-%Y%m%d-%H%M.pcap
Given a pcap file, I'm able to extract a lot of information from the reconstructed HTTP request and responses using the neat filters provided by Wireshark. I've also been able to split the pcap file into each TCP stream.
Trouble I'm running into now is that of all the cool filters I'm able to use with tshark, I can't find one that will let me print out full request/response bodies. I'm calling something like this:
tshark -r dump.pcap -R "tcp.stream==123 and http.request" -T fields -e http.request.uri
Is there some filter name I can pass to -e to get the request/response body? The closest I've come is to use the -V flag, but it also prints out a bunch of information I don't necessary want and want to avoid having to kludge out with a "dumb" filter.
If you are willing to switch to another tool, tcptrace can do this with the -e option. It also has an HTTP analysis extension (xHTTP option) that generates the HTTP request/repsonse pairs for each TCP stream.
Here is a usage example:
tcptrace --csv -xHTTP -f'port=80' -lten capturefile.pcap
--csv to format output as comma sperated variable
-xHTTP for HTTP request/response written to 'http.times' this also switches on -e to dump the TCP stream payloads, so you really don't need -e as well
-f'port=80' to filter out non-web traffic
-l for long output form
-t to give me progress indication
-n to turn off hostname resolution (much faster without this)
If you captured a pcap file, you can do the following to show all requests+responses.
filename="capture_file.pcap"
for stream in `tshark -r "$filename" -2 -R "tcp and (http.request or http.response)" -T fields -e tcp.stream | sort -n | uniq`; do
echo "==========BEGIN REQUEST=========="
tshark -q -r "$filename" -z follow,tcp,ascii,$stream;
echo "==========END REQUEST=========="
done;
I just made diyism answer a bit easier to understand (you don't need sudo, and multiline script is imo simple to look at)
This probably wasn't an option when the question was asked but newer versions of tshark can "follow" conversations.
tshark -nr dump.pcap -qz follow,tcp,ascii,123
I know this is a super old question. I'm just adding this for anyone that ends up here looking for a current solution.
I use this line to show last 10 seconds request body and response body(https://gist.github.com/diyism/eaa7297cbf2caff7b851):
sudo tshark -a duration:10 -w /tmp/input.pcap;for stream in `sudo tshark -r /tmp/input.pcap -R "tcp and (http.request or http.response) and !(ip.addr==192.168.0.241)" -T fields -e tcp.stream | sort -n | uniq`; do sudo tshark -q -r /tmp/input.pcap -z follow,tcp,ascii,$stream; done;sudo rm /tmp/input.pcap