I am trying to determine the amount of data received and transmitted back to a remote telematic device that communicates over GPRS on port TCP X to find out if my wireless carrier is overcharging me. The trick is that the server receives data on that same port from several units. Capture filter: tcp port X Display filter: tcp contains "6033," and (tcp contains ",1710," or tcp contains ",121017,") 6033 is the unique identifier for the device I want to get information from, and 1710 or 121017 is the date I'm interested in the two different possible formats included in the TCP stream. I'm missing some TCP packets that don't have the string '6033' in them, however they are part of the same TCP stream/conversation and should be included in my filtered results. How can I include in my results the missing packets that are part of the TCP stream/conversation BUT don't contain the unique identifier in it? i.e. $G6033,1710,232239,5319.4470,N,00627.4218,W,000 1710,232324,5319.4372,N,00627.4342,W,000 1710,232739,5319.4328,N,00627.4310,W,000 1710,232824,5319.4328,N,00627.4310,W,000 1710,233239,5319.4312,N,00627.4129,W,000 1710,233324,5319.4312,N,00627.4129,W,000 1710,233739,5319.4394,N,00627.4296,W,000 --------- Packet divider (missing from this point on)--------- $A6033,232239,121017,234408*D9 asked 19 Oct '12, 15:56  juanclau |
2 Answers:
As far as I understand this, each unit connects to your server with it's own tcp communication. The "trick" of using always the same port on the server is not really a trick, it is what every server does today (for example the web server of this Q&A page runs on port 80 and takes lots of connections on it). Did you try filtering on the client IP and port instead (meaning the TCP port that the remote device uses)? It is standard filtering operation to isolate TCP flows by filtering on it's socket pairs, or on the unique flow number assigned to each flow by Wireshark. So what you'd need to do is:
You can automate this by using command line scripts with tshark.exe instead, but that might be a bit too complicated for starters. answered 20 Oct '12, 07:49  Jasper ♦♦ |
O.K. so, you can't use a capture filter. Instead I suggest to record the whole communication and later filter it with a display filter. To automate the process on Windows, you can use Powershell. Start powershell and enter these commands (without the 'PS >'). input.cap is the capture file containing the whole communication.
Output should look similar to this:
Wireshark will start with the given display filter and you will see only those streams that contain the search strings. If you want to do the same on Unix:
Regards answered 21 Oct '12, 04:25  Kurt Knochner ♦ edited 21 Oct '12, 04:27 Kurt, Thanks for your answer. Can you explain to me what the command does in a little more detail? Also, correct me if I'm wrong but I believe the filter in the command should be: "tcp contains 6033 and (tcp contains 1710 or tcp contains 121017)" I can't simply use "tcp contains 6033 or tcp contains 1710 or tcp contains 121017" since that would capture other devices with the same date stamps but a different SID (6033). (24 Oct '12, 17:24) juanclau |
Thanks for the quick reply and the help provided.
When I said "the trick" I referred to the fact that I needed to separate the traffic from different sources, not that traffic was on the same port.
Unfortunately these are mobile devices that can change their IPs quite often (several times per day), simply using IP filtering is not really the right way to go.
When I do your suggested solution I get 4 conversations with 4 different IPs. Can I assume the device changed IPs 4 times and the total sum of the 'bytes' column is the amount of data transfer between the server and the mobile device?