invalid address:port pair

Question

I ran this script:

file=man.pcap
for stream in $(tshark -nlr $file -Y tcp.flags.syn==1 -T fields -e tcp.stream | sort -n | uniq)
do
  echo "Processing stream $stream"
  tshark -nlr $file -qz "follow,tcp,ascii,$stream" > stream-$stream.log
done

but I got this message for all streams:

Processing stream 0 tshark: follow - Invalid address:port pair. Processing stream 1 tshark: follow - Invalid address:port pair.

Processing stream 2 tshark: follow - Invalid address:port pair.

. . .

what is the reason?

Accepted Answer

what is the reason?

There is a carriage return that needs to be removed. Try something like the following:

file=man.pcap
for stream in $(tshark -nlr $file -Y tcp.flags.syn==1 -T fields -e tcp.stream | sort -n | uniq | sed 's/\r//')
do
    echo "Processing stream $stream"
    tshark -nlr $file -qz "follow,tcp,ascii,$stream" > stream-$stream.log
done