How to display the full TCP payload from a pcap using tshark?

Question

I have tried the following tshark command and the matching is working fine

tshark -R "tcp contains SEK" -2 -r 2015-03-04.pcap -T fields -e tcp

However, the output of the tcp field doesn't include the full data payload. Instead it contains a friendly summary.

Transmission Control Protocol, Src Port: 18083 (18083), Dst Port: 53649 (53649), Seq: 1, Ack: 1, Len: 205

I've done a bunch of Googling and have found similar questions, but the fields they indicate to use don't exist or are empty. I've tried tcp.data, data.data, text, tcp.segment_data and some others.

broset's answer to this question came close in that it appears to get me the undecoded payload.

How do I instruct tshark to output the full decoded TCP payload without any ethernet, IP or TCP headers? Ideally I could do this without disabling the protocol dissector in Wireshark.

Thanks much, Rob

Answer 1

You can do it in two steps.

tshark -R "tcp contains SEK" -2 -r 2015-03-04.pcap -T fields -e tcp.stream

Take the stream numbers from the output and run the following command:

ASCII:

tshark -nr 2015-03-04.pcap -q -z follow,tcp,ascii,xxxxx

Hex:

tshark -nr 2015-03-04.pcap -q -z follow,tcp,hex,xxxxx

Please replace xxxxx with the tcp stream number.

Obviously you can automate the whole process with a script.

Regards
Kurt