This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I would like to output the raw packets for just one thread. E.g. something like:

tshark -r in.cap -z"follow,tcp,hex,1.2.3.4:2000,1.2.3.9:2001" -F pcap -w out.cap

The -z follow... switch does the job in principle but only seems to do text output. Adding -w gives no output. Is there an equivalent filter for -R or -Y?

asked 31 Oct '13, 06:13

wiggers's gravatar image

wiggers
315511
accept rate: 0%


Sounds like you want to save one conversation in a new capture file.

If so, please run tshark with the appropriate display filter

tshark -nr input.pcap -Y "ip.addr eq 1.2.3.4 and ip.addr eq 1.2.3.9 and tcp.port eq 2000 and tcp.port eq 2001" -F pcap -w out.pcap

Regards
Kurt

permanent link

answered 02 Nov '13, 16:56

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Using .addr and .port is the key, I thought you needed src or dst as well.

(04 Nov '13, 02:25) wiggers

.addr is both directions, so it matches for .src and .dst.

(04 Nov '13, 05:15) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×24

question asked: 31 Oct '13, 06:13

question was seen: 1,301 times

last updated: 04 Nov '13, 05:31

p​o​w​e​r​e​d by O​S​Q​A