This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a trace file with 2000 streams. I open this trace with wireshark in windows. for my work I need to create separate txt files that each file contains a tcp stream. but in wireshark I can see one stream each time by tcp follow and I should save the stream files one by one! how can I have these streams in separate files in easy way?! many thanks.

asked 25 Aug '13, 04:26

Soroor's gravatar image

Soroor
21448
accept rate: 0%


You might want to try tools other than Wireshark, e.g. TCPFlow.

permanent link

answered 25 Aug '13, 04:54

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

You can use some scripting around tshark to do that:

for stream in $(tshark -nlr <file> -R tcp.flags.syn==1 -T fields -e tcp.stream | sort -n | uniq)
do
  echo "Processing stream $stream"
  tshark -nlr <file> -qz "follow,tcp,ascii,$stream > stream-$stream.log
done
permanent link

answered 25 Aug '13, 06:27

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

first many thanks for your answer. actually I am new in this field. I know this code is useful but I have not any idea how can I use it in tshark! I whould be many thankful if you could help me more about running tshark and use of this code.

(26 Aug '13, 02:43) Soroor
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×29

question asked: 25 Aug '13, 04:26

question was seen: 3,453 times

last updated: 26 Aug '13, 02:47

p​o​w​e​r​e​d by O​S​Q​A