This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark output with port number

greetings!

I'd like to know if it's possible to make tshark output packets with port number. For example, I use the following command:

tshark -R "ip.addr==1.1.1.1"

and I get:

163.742781 2.2.2.2 -> 1.1.1.1 SIP Request: INVITE sip:[email protected];user=phone

163.743301 1.1.1.1 -> 2.2.2.2 ICMP Destination unreachable (Port unreachable)

and here I don't see what port the INVITE was sent to. Is there an option to have a port in the output?

Thanks

attribute tshark options

asked 13 Dec '12, 02:00

ky4k0b
11●3●3●6
accept rate: 0%

One Answer:

You could try to build your own customized output.

tshark -r input.cap -R "ip.add == 1.1.1.1" -T fields -e frame.number -e frame.time -e ip.src -e ip.dst -xxx

where XXX is all SIP/VOIP fields you are interested in. The port number would be sdp.media.port (-e sdb.media.port). You will get all available fields with

tshark -G fields

Suggestion (please adjust to your needs!)

tshark -r input.cap -R "ip.addr == 1.1.1.1" -T fields -e frame.number -e frame.time_delta -e ip.src -e ip.dst -e "sip.Request-Line -e sdp.media.port

BTW: the ICMP port unreachable message directly after the SIP INVITE makes me believe, that your system 1.1.1.1 does not accept traffic to port UDP 5060 (SIP) and thus it sends a "port unreachable" message.

Regards
Kurt

answered 14 Dec '12, 07:19

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

thanks a lot Kurt!

I knew that I can do it with -e flag and add custom params. I was just wondering if there's a dummy mode (like another flag) to display port in the output :)

(20 Dec '12, 02:13) ky4k0b

well, you can use the option -V or -T pdml but then you get a lot of data and you need some script to extract the parts you are interested in.

(20 Dec '12, 03:34) Kurt Knochner ♦