This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

headless automate export object when capturing packeting

0

Hello,

Is there possible to run wireshark and exporting http objects (file -> export -> objects -> http feature), and automate saving these objects to files under the structed path in GET header while wireshark is caputing packet and running in headless mode.

How?

Thanks,

asked 06 Nov '12, 00:09

wiresharknewbite_1's gravatar image

wiresharknew...
1111
accept rate: 0%


3 Answers:

0

I don't think this is possible at the moment; exporting objects is "manual mode only" as far as I can tell.

answered 06 Nov '12, 01:04

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

Unfortunately this is not possible in GUI mode, at least not in an automated ("headless") way. You could try to use an external GUI automation tool like AutoIt (or similar), but I'm not sure it that will work with GTK.

Can you please tell us more about the goal you want to achieve?

Maybe there is another way, like one of these tools

Regards
Kurt

answered 06 Nov '12, 01:08

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 06 Nov '12, 01:10

actually I need to monitor live network traffic and give live report on the keyworks in html transmated file. and the url of that file.

(06 Nov '12, 01:26) wiresharknew...

well, I don't think that wireshark is the right tool for your job.

Wireshark is a network analyzer and people use it to troubleshoot network problems. I suggest you take a look at these tools.

BTW: assniffer, together with a script could possibly do the job.

Maybe it's even easier to use a HTTP proxy and extract the required information there.

Regards
Kurt

(06 Nov '12, 01:49) Kurt Knochner ♦

0

You can't save the full GET path, but as of Wireshark 2.3.0, you can export HTTP objects with tshark.

Wireshark 2.3.0 hasn't been released yet, so you can grab a daily build from here. To extract HTTP objects from the command-line, run the following command:

tshark -r mypcap.pcap --export-objects "http,destdir"

answered 13 Dec '16, 15:31

moshe's gravatar image

moshe
21125
accept rate: 0%

edited 13 Dec '16, 15:32