This is our old Q&A Site. Please post any new questions and answers at


please I have the following challenges using Tshark, though I have achieved it in wireshark, but it cost me too many time. So want to autorun tshark to do same. But I have been having difficulty achieving any.

  1. merge and filter series of dumped traffic for sequence of IP addressed (example,, and so on), combined with same argument (as in "http.request.method==GET or ((tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==443) or (tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==22) ).
  2. export this filtered output as a .csv file.

Please how can I do it... in tshark?

asked 22 Aug '13, 21:22

Hunted's gravatar image

accept rate: 0%

edited 24 Aug '13, 01:13

SYN-bit's gravatar image

SYN-bit ♦♦

The display filter part would be the same for Wireshark and Tshark. You can set the display filter for tshark with the option "-Y" (or "-R" in versions up to 1.8):

tshark -r <file> -Y "(ip.addr== or ip.addr== or ip.addr== and ("http.request.method==GET or (tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==443) or (tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==22) )"

As for the CSV output, have a look at the -T field options of tshark:

  -T pdml|ps|psml|text|fields
                           format of text output (def: text)
  -e <field>               field to print if -Tfields selected (e.g. tcp.port, col.Info);
                           this option can be repeated to print multiple fields
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
     quote=d|s|n           select double, single, no quotes for values

(from "tshark -h")

permanent link

answered 24 Aug '13, 01:18

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

thanks, its now working...

tshark -r <file> -Y "(ip.addr== or ip.addr== or ip.addr== and ("http.request.method==GET" or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )"

However, I have another challenge. when i attempt to autorun this code using batch file process (using windows), I discovered that it does not accept it, rather it attempts to capture the traffic on my network. I want it to dissect the specified file. Is there a way to instruct it (tshark) to dissect the given file, and not to capture another traffic..?

Thanks in anticipation of your response.

(25 Aug '13, 09:38) Hunted

Your other challenge has been converted into a separate question; that's how a Q&A site such as this should work (Q&A sites aren't forums).

(25 Aug '13, 10:10) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 Aug '13, 21:22

question was seen: 3,536 times

last updated: 25 Aug '13, 16:59

p​o​w​e​r​e​d by O​S​Q​A