This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there any concept of flow id in tshark ? When i searched for filters, i found out that tcp.stream exists but its equivalent for udp i.e udp.stream doesn't exist. When i open a pcap, by default it shows the frame number, ip addresses, info etc. In one column i also need the flow id of each packet alongwith the frame number. Does tshark provide such support ? If not, Is there any way i can do this ?

I have written a program where i am reading a pcap file, packet by packet and i need the flowid for each packet read. If i use tshark command as

 ./tshark -r in.pcap -z conv,tcp

it displays the packet number alongwith some other details, but i want the flowid also to be displayed which i can read in my program.

any help will be greatly appreciated. thanks.

asked 20 Oct '12, 22:06

viks's gravatar image

viks
16447
accept rate: 0%

i just need the udp flow id (similar to that given by tcp.stream for the tcp flows) for the udp packets. plz let me know how to do that ? thanks

(26 Oct '12, 01:08) viks

Unfortunately, there is no "UDP stream/flow" recorded in Wireshark. The best you can do is to print the UDP conversations and then filter on the connection parameters (IP + port) with a script in a second run.

tshark -n -q -r input.cap -z conv,udp

Regards
Kurt

permanent link

answered 29 Oct '12, 04:20

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

@kurt : thanks for the reply. for the tshark command that u told, i will get the src(ip+port), dest(ip+port) and that alongwith transport proto (tcp/udp) will give me the 5tuple. Now how to calculate flowid from that. Can you please let me know how to calculate that using some script or c code ? Is there some already existing library which provides this functionality ?

(30 Oct '12, 00:16) viks

@viks, there is no "flowid" or anything similar, neither in UDP nor in Wireshark. However, you can "simulate" that in your script. As soon as the first packet with a yet unseen 5-tupel appears, you remember that conversation as "flow" number #1, then you proceed in the same way with all other conversations. Usually this is done with a hash table where the 5-tuple is the key to the hash table.

(30 Oct '12, 03:05) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×238
×61
×35

question asked: 20 Oct '12, 22:06

question was seen: 4,456 times

last updated: 30 Oct '12, 03:05

p​o​w​e​r​e​d by O​S​Q​A