Hello, I would like to convert tcpdump output into tshark standard decoded output. As you know tcpdump don't summarize gathered data just like tshark does it. That's too bad, because there are so many doubled values in the pcap file: for example: I would like to have decoded output, similiar to this from t-shark It does job well, however i'm having doubled lines, however it's the same connection: asked 19 Sep '12, 05:36  cps86 |
One Answer:
The beauty of writing a script to do some work for you is that you can make it do exactly what YOU want. It is quite easy to extend the script that you are referring to, to make is combine both flows of the TCP session into one output line. I have done so in the past... Hmmm... looking at the script you are referring to, it should not produce the output you are showing. Did you alter the script to your needs already? You can use a conversation index based on IP addresses and ports, and determine the direction of traffic by swapping the src and dst if the dst port is higher than the src port. Just a suggestion... answered 20 Sep '12, 23:35  SYN-bit ♦♦ |
