I am trying to use tshark to produce either a tab or comma delimited file with various fields from a pacap file that I have. I have tried 2 different methods and each has it's own shortcoming. I am hoping that some one can help remedy my ignorance. I have been searching here, google, and a few other sites with no luck. First method: tshark -r <pcapfile.pcap> -t ad -E header=y -E separator=/t -T fields -e frame.number -e frame.time -e tcp.stream -e ip.src -e ip.src_host -e ip.dst -e ip.dst_host -e Protocol First Result: With this I get most of the data that I want. But I have not been able to to to get the contents of Wiresharks 'Protocol' Column. I have used both -e protocol and -e Protocol as the filed name, neither generates an error or provides data. But -e fred does the same. In Wireshark the column details are displayed as 'Protocol' (no 's), in the preferences file the protocol column is defined as %p. Using -e %p does generate and error. Second method: tshark -r <pcapfile.pcap> -t ad -E header=y -E separator=/t -C <profilename> Second Result: This does output all of the same data that I see in Wireshark. But, I seem to not be able to get column headers or field separators. Now that I have went through all of this, It seems that what I want to know is 2 basic questions; 1) how can I get the 'paramterized' columns from Wireshark like 'Protocol(%p)', 'Cumulative Bytes(%B)',etc. list listed by tshark in formatted text? 2) how can I get tshark to display formatted text (headers and files separators) when using a configuration profile "-C" parameter. Any help with this would be greatly appreciated. asked 02 May '14, 15:20 astrader |
2 Answers:
In general, to display an arbitrary column, use answered 02 May '14, 16:18 cmaynard ♦♦ |
As of the 1.11.x and 1.12 versions of tshark, the field names are "_ws.col.Protocol" and "_ws.col.Info", instead of "col.Protocol" and "col.Info". Example:
Source: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10201 answered 19 Jun '14, 16:59 CraigGarrett edited 20 Jun '14, 10:20 thanks for the update. I will have to grab a newer version and give this a try. (20 Jun '14, 12:17) astrader |
That is exactly what I was looking for. That is exactly the bit of ignorance that was holding me up. I was not aware ot the col item.
Thanks!