This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.
tshark -r <file> -Y "(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and ("http.request.method==GET" or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )"

When i attempt to autorun this code using batch file process, I discovered that it does not accept it, rather it attempts to capture the traffic on my network. I want it to dissect the specified file. Is there a way to instruct it (tshark) to dissect the given file, and not to capture traffic..?

Thanks in anticipation of your response.

asked 25 Aug '13, 09:36

Hunted's gravatar image

Hunted
11334
accept rate: 0%

converted to question 25 Aug '13, 10:07

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

You say "batch file", which is a term used more on Windows than on UN*X; is this on Windows or on UN*X (note: Linux and OS X are versions of UN*X)?

What are the exact contents of the batch file in question?

(25 Aug '13, 10:09) Guy Harris ♦♦

Did you put "<file>" literally in your batch file? The word "<file>" should be replaced by the name of the packet capture file that you want to analyze.

permanent link

answered 25 Aug '13, 16:30

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 25 Aug '13, 16:30

tshark -r <file> -Y "(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and ("http.request.method==GET" or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )"
When i attempt to autorun this code using batch file process, I discovered that it does not accept it

The reason is the wrong number of quotes " in the argument string. Your shell will get confused by the additional quotes around http.request.method.

Please try this

tshark -r <file> -Y "(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and (http.request.method==GET or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )"

or this (single quotes)

tshark -r <file> -Y '(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and (http.request.method==GET or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )'

Regards
Kurt

permanent link

answered 26 Aug '13, 06:25

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 26 Aug '13, 06:26

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832

question asked: 25 Aug '13, 09:36

question was seen: 1,524 times

last updated: 26 Aug '13, 06:26

p​o​w​e​r​e​d by O​S​Q​A