I need to take a pcap file import it into wire shark, filter it for dicom and then export the Packet Dissections as plain text. I'm doing it manually at the moment in wireshark, but was wondering if there was a way to do this from the command line. TIA. B. asked 12 Jun '14, 13:09  BJOBrien edited 12 Jun '14, 13:10 |
2 Answers:
(or You might have to use answered 12 Jun '14, 13:30  Guy Harris ♦♦ showing 5 of 6 show 1 more comments |
Please try this
Regards answered 12 Jun '14, 13:30  Kurt Knochner ♦ O.k. @Guy Harris was 28 seconds faster ;-) (12 Jun '14, 13:31) Kurt Knochner ♦
See the answer to this question
(12 Jun '14, 13:52) Kurt Knochner ♦ |
I didn't find any tshark executable on my Mac
If you installed Wireshark from a dmg downloaded from Wireshark.org, try re-installing it, and don't un-check the install option for the command-line tools. That should put a tshark command in
/usr/local/bin.If you installed Wireshark from somewhere else, check with whatever source provided Wireshark to see how to get the command-line tools installed.
if my dicom server is listening on port 11112 Woud filtering on dicom (within wireshark) work or does dicom filtering assume port 104?
DICOM filtering assumes that Wireshark/TShark/whatever dissected the packet as DICOM.
DICOM dissection assumes port 104 by default; that's why I said "You might have to use
-o dicom.tcp.port:NNNNif the DICOM traffic is on port NNNN rather than the default port, 104."So, if the DICOM server is listening on port 11112, you'd need to do
in TShark, and would need to change the DICOM preference "DICOM ports" to include port 11112 in Wireshark.
So if I want dicom on both port 104 and port 11112 then I specify both separated by a comma in the prefrenced?
P.S. I had different columns selected in wireshark, like Source Port and Destination Port. I assume those columns that I want to include in my text export can be specified on the tshark command line as well?
What if I don't want the TCP/IP portion of the text output but just the DICOM message?
Yes.
You said "export the Packet Dissections as plain text"; I assume you meant you just wanted the information that shows up in the "packet details" pane in Wireshark. What exactly do you want the text output to contain? Summary pane (the columns)? Detail pane? Hex dump?
You can't completely eliminate the TCP/IP portion, but
-O dicomshould cause the TShark output to look like the packet detail pane with eveything but DICOM closed.