This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Running TShark in a batch file with -r attempts to capture traffic rather than reading the file

0
tshark -r <file> -Y "(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and ("http.request.method==GET" or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )"

When i attempt to autorun this code using batch file process, I discovered that it does not accept it, rather it attempts to capture the traffic on my network. I want it to dissect the specified file. Is there a way to instruct it (tshark) to dissect the given file, and not to capture traffic..?

Thanks in anticipation of your response.

asked 25 Aug '13, 09:36

Hunted's gravatar image

Hunted
11334
accept rate: 0%

converted to question 25 Aug '13, 10:07

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

You say "batch file", which is a term used more on Windows than on UN*X; is this on Windows or on UN*X (note: Linux and OS X are versions of UN*X)?

What are the exact contents of the batch file in question?

(25 Aug '13, 10:09) Guy Harris ♦♦

2 Answers:

0

Did you put "<file>" literally in your batch file? The word "<file>" should be replaced by the name of the packet capture file that you want to analyze.

answered 25 Aug '13, 16:30

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 25 Aug '13, 16:30

0

tshark -r <file> -Y "(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and ("http.request.method==GET" or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )"
When i attempt to autorun this code using batch file process, I discovered that it does not accept it

The reason is the wrong number of quotes " in the argument string. Your shell will get confused by the additional quotes around http.request.method.

Please try this

tshark -r <file> -Y "(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and (http.request.method==GET or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )"

or this (single quotes)

tshark -r <file> -Y '(ip.addr==10.1.1.2 or ip.addr==10.2.4.12 or ip.addr==10.5.3.6) and (http.request.method==GET or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==443) or (tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.port==22) )'

Regards
Kurt

answered 26 Aug '13, 06:25

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 26 Aug '13, 06:26