tshark http dissection of captured dump

Question

Hi,

please I have the following challenges using Tshark, though I have achieved it in wireshark, but it cost me too many time. So want to autorun tshark to do same. But I have been having difficulty achieving any.

merge and filter series of dumped traffic for sequence of IP addressed (example 10.1.1.2, 10.2.4.12, 10.5.3.6 and so on), combined with same argument (as in "http.request.method==GET or ((tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==443) or (tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==22) ).
export this filtered output as a .csv file.

Please how can I do it... in tshark?

Answer 1

The display filter part would be the same for Wireshark and Tshark. You can set the display filter for tshark with the option "-Y" (or "-R" in versions up to 1.8):

tshark -r <file> -Y "(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and ("http.request.method==GET or (tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==443) or (tcp.flag.syn==1 && tcp.flag.ack==0 && tcp.port==22) )"

As for the CSV output, have a look at the -T field options of tshark:

  -T pdml|ps|psml|text|fields
                           format of text output (def: text)
  -e <field>               field to print if -Tfields selected (e.g. tcp.port, col.Info);
                           this option can be repeated to print multiple fields
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
                           aggregator
     quote=d|s|n           select double, single, no quotes for values

(from "tshark -h")