This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello, do anyone know to deal with it?

I have a captured *.pcapng file and it has lots of data. I hope to filter specified port's log to another pacapng file in command line. Could it be possible?

If Wireshark/tshark does not provide this method, whether it is possible to complete it with lua?

Thanks a lot.

asked 12 Jul '16, 19:03

Youping%20Kang's gravatar image

Youping Kang
6112
accept rate: 0%

edited 14 Jul '16, 00:29

sindy's gravatar image

sindy
6.0k4851


You can certainly do that with Wireshark. Load the file, apply a display filter to select only those packets you are interested in, then save the file selecting to save only those frames shown.

permanent link

answered 12 Jul '16, 23:47

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thank you Jaap. But what I will filter is volume data and thousands of files. I could not operate this way one by one. So I need a way in command line.

(13 Jul '16, 21:29) Youping Kang

The command line tool is called tshark, the manual is here.

In short, you would use

tshark -r original_pcapng_to_be_filtered -Y "your_display_filter_expression" -w filtered_pcapng_file_to_be_written.

You'll use a script to provide the input and output file names.

(14 Jul '16, 00:33) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×42
×30
×23
×16

question asked: 12 Jul '16, 19:03

question was seen: 963 times

last updated: 14 Jul '16, 00:33

p​o​w​e​r​e​d by O​S​Q​A