This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

greetings!

I'd like to know if it's possible to make tshark output packets with port number. For example, I use the following command:

tshark -R "ip.addr==1.1.1.1"

and I get:

163.742781 2.2.2.2 -> 1.1.1.1 SIP Request: INVITE sip:[email protected];user=phone

163.743301 1.1.1.1 -> 2.2.2.2 ICMP Destination unreachable (Port unreachable)

and here I don't see what port the INVITE was sent to. Is there an option to have a port in the output?

Thanks

asked 13 Dec '12, 02:00

ky4k0b's gravatar image

ky4k0b
11336
accept rate: 0%


You could try to build your own customized output.

tshark -r input.cap -R "ip.add == 1.1.1.1" -T fields -e frame.number -e frame.time -e ip.src -e ip.dst -xxx

where XXX is all SIP/VOIP fields you are interested in. The port number would be sdp.media.port (-e sdb.media.port). You will get all available fields with

tshark -G fields

Suggestion (please adjust to your needs!)

tshark -r input.cap -R "ip.addr == 1.1.1.1" -T fields -e frame.number -e frame.time_delta -e ip.src -e ip.dst -e "sip.Request-Line -e sdp.media.port

BTW: the ICMP port unreachable message directly after the SIP INVITE makes me believe, that your system 1.1.1.1 does not accept traffic to port UDP 5060 (SIP) and thus it sends a "port unreachable" message.

Regards
Kurt

permanent link

answered 14 Dec '12, 07:19

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

thanks a lot Kurt!

I knew that I can do it with -e flag and add custom params. I was just wondering if there's a dummy mode (like another flag) to display port in the output :)

(20 Dec '12, 02:13) ky4k0b

well, you can use the option -V or -T pdml but then you get a lot of data and you need some script to extract the parts you are interested in.

(20 Dec '12, 03:34) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×16
×2

question asked: 13 Dec '12, 02:00

question was seen: 11,109 times

last updated: 20 Dec '12, 03:34

p​o​w​e​r​e​d by O​S​Q​A