This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello, I have captured a Wireshark file and would like to extract some information using Tshark. The below command is what I have been using:

tshark -r c:\temp\test.pcap >c:\temp\test1.csv -T fields -e ip.src_host -e ip.dst_host -e ip.proto

Issue 1 = Not resolving IP addresses to network names. When I captured the PCAP file, I had "Enable Name Resolution". But after exporting to CSV, the IP addresses are not resolved. If I do not export to a CSV file, then the names are resolved to the stdout (screen).

Issue 2 = The "ip.proto" filed does print the protocol, but as a number. Is there a way to print the protocol as a text. For example, ip.proto = 6 should be printed as TCP.

asked 07 Sep '12, 12:37

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%


Technically, "127.0.0.1", or whatever the IP address is, and 6 are the values of the field, so that's what it's printing.

The problem is that there really should be a way to, in the -e flag, specify whether the "resolved" value of the field or the "raw" value of the field should be reported (there are probably cases where the raw value is desired); please file a bug for this on the Wireshark Bugzilla.

permanent link

answered 07 Sep '12, 14:32

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

I submitted bug 7712

(10 Sep '12, 08:50) Amato_C

Issue 1 = Not resolving IP addresses to network names. When I captured the PCAP file, I had "Enable Name Resolution". But after exporting to CSV, the IP addresses are not resolved. If I do not export to a CSV file, then the names are resolved to the stdout (screen)

This works well on my system (Win7_64, WS 1.8.x). ip.src_host and ip.dst_host DO print the resolved names, but only if name resolution is enabled while tshark runs.

From your bug report.

It appears that only known IP addresses are being resolved. Tshark should try to resolve all IP addresses.

What do you mean bye "only known IP addresses" are beeing resolved? Tshark asks the resolver of the OS and if the resolver is unable to resolve an IP address to a name (no PTR record, timeout, whatever problem else), it cannot show the resolved names.

Maybe I don't fully understand your problem, but it works as expected on my system.

However, it does not help to enable name resolution during capturing. If you want Wireshark to store the resolved names during the capture phase, wireshark needs to be extended to write those names (plus the raw IP addresses) to a pcapng file and tshark/wireshark needs to be extended as mentioned by Guy Harris.

Regards
Kurt

permanent link

answered 10 Sep '12, 09:19

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Thank you for the reply Kurt. Let me better explain what I mean by "only known addresses" are being resolved. The PCAP file I included in the bug report contains both public and private IP addresses. After executing the Tshark command, the prublic IP addresses are being resolved. For example: 74.125.137.94 resolves to www.google.ca (packet #5). However, the private IP addresses are not being resolved in the Tshark analysis. Referring to PCAP file in the bug report, please look at packet #6. In the Tshark analysis, the private IP address is not being resolved. Wireshark resolves these IPs

(10 Sep '12, 11:49) Amato_C

In the Tshark analysis, the private IP address is not being resolved. Wireshark resolves these IPs

O.K. if that's the case, I would think it's a bug. Are you sure that name resolving for those private addresses do work in your environment? Do you have PTR records for them in your local DNS server?

(10 Sep '12, 18:55) Kurt Knochner ♦

I am certain that the names are being resolved in Wireshark and not in Tshark. Yes, the PTR records exist. I created bug 7712.

(11 Sep '12, 06:36) Amato_C
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×34
×20
×1

question asked: 07 Sep '12, 12:37

question was seen: 4,316 times

last updated: 11 Sep '12, 06:36

p​o​w​e​r​e​d by O​S​Q​A