This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Generating TSHARK decoded output from TCPDUMP PCAP file ? without tshark

0

Hello,

I would like to convert tcpdump output into tshark standard decoded output. As you know tcpdump don't summarize gathered data just like tshark does it. That's too bad, because there are so many doubled values in the pcap file: for example:
ipsrc,port,ipdest,port,data_sent
10.38.39.245,1267,10.238.125.83,9999,0
10.38.39.245,1267,10.238.125.83,9999,116
10.227.40.61,2491,10.238.125.83,9999,0

I would like to have decoded output, similiar to this from t-shark
TSHARK:
10.238.125.83:9999 <-> 10.197.118.246:4412 276 29298 0 0 276 29298 42.208780000 1755.1373
10.39.0.144:55296 <-> 10.238.125.83:9999 0 0 205 22974 205 22974 40.616219000 1746.5140
10.238.125.83:9999 <-> 10.99.156.29:1075 199 20184 0 0 199 20184 2.779606000 1784.9520
10.238.125.83:9999 <-> 10.99.176.220:1226 198 20412 0 0 198 20412 14.735165000 1781.4088

I've found some information on this site: http://hype-free.blogspot.fr/2010/03/parsing-pcap-files-with-perl.html

It does job well, however i'm having doubled lines, however it's the same connection:
10.197.191.250:445 10.197.191.50:47766 778663
10.197.191.50:47766 10.197.191.250:445 739008

Have you ever managed to do this correctly in Perl?

asked 19 Sep '12, 05:36

cps86's gravatar image

cps86
1111
accept rate: 0%


One Answer:

0

The beauty of writing a script to do some work for you is that you can make it do exactly what YOU want. It is quite easy to extend the script that you are referring to, to make is combine both flows of the TCP session into one output line. I have done so in the past...

Hmmm... looking at the script you are referring to, it should not produce the output you are showing. Did you alter the script to your needs already? You can use a conversation index based on IP addresses and ports, and determine the direction of traffic by swapping the src and dst if the dst port is higher than the src port. Just a suggestion...

answered 20 Sep '12, 23:35

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%