This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the filter to extract TCP packets? (in wireshark)

0

Anyone knows, please tell me. Your help is highly appreciated.

asked 01 Dec '13, 22:10

Eliza%20Rana's gravatar image

Eliza Rana
11●4●5●8
accept rate: 0%

edited 01 Dec '13, 22:19

2 Answers:

1

You can use tshark as following on Linux/OSX:

tshark -R "tcp" -r [path-to-file]

or if your on Windwos and tshark is not in your path open Command Prompt aka CMD:

cd C:\Program Files\Wireshark
tshark.exe -R "tcp" -r [path-to-file]

You can view all options of tshark command with -h:

tshark -h

Let us know.

answered 02 Dec '13, 02:59

Edmond's gravatar image

Edmond
181●3●6●14
accept rate: 33%

Thanks for your help, Edmond. I would like to ask you one more question.

Here is my assignment: Plot time-series graph for number of TCP packets per 1 second.

I am plotting this graph using R programming in Windows. And I have to read csv file(that is transformed from pcap file) into R and then plot the time-series graph. In order to plot a graph, there must be 2 values x and y. So I consider x as frame.time. And the y must be the number of TCP packet per 1 second, but I don't know what it is and how to calculate it.

So could you help me please?

(02 Dec '13, 08:30) Eliza Rana

0

All the info you need for tshark can be found on the man page, or a summary by giving tshark a -h parameter.

For filters, you need to look at Capture Filters and Display Filters. Which one to use depends on your task and environment.

answered 02 Dec '13, 02:52

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206
accept rate: 22%

edited 02 Dec '13, 02:52