Can anyone please tell me what is the difference between wireshark, ethereal and tshark ? And which one should be used for my below problem ?
i want to save the major udp/tcp flows (by major i mean having maximum number of bytes) using command line ethereal (or tshark/wireshark if not possible with ethereal) , to a separate pcap. Then sometimes, i would like to even save the 2nd major udp & tcp flows (want to save udp and tcp flows separately) in a separate pcap. just to start with using command line ethereal, i used following cmd to save tcp conversation in a separate pcap file but this too doesn't work (rather it opens a gui window with tcp flows but doesn't save in separate file)
Please let me know how can i save the major flows. any help will be greatly appreciated. thanks.
asked 17 May '12, 05:08
Ethereal is the old name for Wireshark and any executables of that name are obsolete and shouldn't be used.
Wireshark is a GUI protocol analyzer, tshark is the command line version of Wireshark. tshark can output conversations (the *shark name for flows) using the
To save each flow in the original capture file to a separate file of its own will require some scripting to:
answered 17 May '12, 06:08