Menu
Given a pcap file, I'm able to extract a lot of information from the reconstructed HTTP request and responses using the neat filters provided by Wireshark. I've also been able to split the pcap file into each TCP stream.
Trouble I'm running into now is that of all the cool filters I'm able to use with tshark, I can't find one that will let me print out full request/response bodies. I'm calling something like this:
tshark -r dump.pcap -R "tcp.stream==123 and http.request" -T fields -e http.request.uri
Is there some filter name I can pass to -e to get the request/response body? The closest I've come is to use the -V flag, but it also prints out a bunch of information I don't necessary want and want to avoid having to kludge out with a "dumb" filter.
658
By using -w options, user can easily copy all output of tshark tool into single file of format pcap. By using option -r with tshark, user can read saved pcap file easily. If user wants to capture network traffic from the live network for a specific period of time, just use -a option.
And at any point, you can press Ctrl+C to stop TShark from capturing packets. Like other popular data-network packet analyzer tools, such as tcpdump and Wireshark, Tshark uses the pcap library (libpcap) to capture packets. In this case, TShark uses the pcap library to capture packets from the eth0 interface.
Even though both tools are almost equivalent in traffic capturing functionality, tshark is a lot more powerful. The best you can do is to use tshark to set up a port in your server that forwards information to your system, so you can capture traffic for analysis using a GUI.
To specify a capture filter, use tshark -f "${filter}" . For example, to capture pings or tcp traffic on port 80, use icmp or tcp port 80 . To see how your capture filter is parsed, use dumpcap.
This probably wasn't an option when the question was asked but newer versions of tshark can "follow" conversations.
tshark -nr dump.pcap -qz follow,tcp,ascii,123
I know this is a super old question. I'm just adding this for anyone that ends up here looking for a current solution.
70
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
