You can answer with any programming language
O.K. Then I choose Perl.
#!/usr/bin/perl
use GUI::Testing;
$wireshark_bin = which wireshark
;
chomp($wireshark_bin);
$capture_file = 'input.pcap';
if ($pid = fork()) {
parent process ….
wait while Wireshark is starting …
sleep(30);
get a GUI handle for Wireshark
$ws_handle = get_gui_handle($wireshark_bin);
get a handle for the IO Graph
$io_graph = $ws_handle.menu("Statistics::IO Graph");
$io_graph.tick_interval = "1";
$io_graph.pixel_per_tick = "5";
$io_graph.y_axis_unit = "packets/tick";
$io_graph.y_axis_scale = "auto";
set the display filter for graph 1.
Alternative filter: tcp.stream eq 2
Alternative filter: tcp.port eq 80
$io_graph.graph_1.filter = "tcp";
$io_graph.graph_1.style = "line";
$io_graph.graph_1.redraw();
$data = $io_graph.copy_data();
analyze_data($data);
} else {
child process
system("$wireshark_bin -nr $capture_file");
}
sub analyze_data {
my $data = shift;
print STDERR "Please write your own code to analyze the data\n";
print STDERR "like calculation of mean or median values\n";
}
Hint: ‘Listen’ to the code …..
Regards
Kurt
answered 30 Nov ‘13, 15:08
Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%
Thanks so much for ur help, Kurt!!! I will install Perl and try this code…I would like to ask u one more question:
I want to transform the pcap file to csv file by using tshark command, but I got “Access is denied”.
Here is what i wrote: tshark -r “d:\test.pcap” -T fields -e frame.time -e ip.proto -e frame.len -E header=y -E separator=, > “d:\file.csv”
Note: I want to transform only the following datas into csv format: - Timestamp - Protocol - Packet_length Timestamp must be with a format that we can understand. for example, 20/01/2013 00:00:00 And for protocol: I want to show only the top-level protocol such as TCP, UDP, etc.
hm… if my Windows shows that message, it usually want’s to tell me that I am not allowed to read or write a file. Maybe your Windows is doing that too!?!
So what should i do kurt? Any other solution? Is what I wrote correct or not?
If I want to use tshark command in windows, do i have to install Cygwin or just use the cmd command prompt? I really don’t know about this.
No need for Cygwin to run tshark, it will run from a cmd prompt (or a PowerShell one).
Thanks so much grahamb…