Extract HTTP POST packets using tshark

Question

Hello.

I have a capture file named original.pcap from a wifi capture I did. When I open it in Wireshark and properly configure decryption, I can see two HTTP POST packets. When I double-click any of those packets, I got a window that shows me the packet in three different view modes (Frame, Decrypted CCMP data and Reassembled TCP). So far, so good.

Now, I'm trying to create a new file named post.pcap using tshark with those HTTP POST packets only. I tried the following command (no copy/paste here, please ignore any typos):

tshark -r original.pcap -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" MyPassword:MySSID\"" -Y "http.request.method == "POST" or eapol" -w post.pcap

I used UAT to config decryption in tshark. Also, I extracted eapol packets so tshark can do the decryption.

But when I open post.pcap in Wireshark, I can see the EAPOL packets and just two TCP packets, not the HTTP packets I was expecting. If I double-click one of those TCP packets, I can see it is related to the original HTTP POST, but it shows me only two view modes (Frame and Decrypted CCMP data). It seems that I need more packets in the original file in order to properly show the HTTP packets.

How can I make tshark extract the right combination of packets?

Thanks.

Accepted Answer

0

There may be a way to accomplish this in a single step (possibly using MATE or some other method?), but you should be able to at least use a 2-step approach to have tshark extract the packets you need.

First, find the relevant TCP stream(s) (options omitted for brevity and clarity):

tshark -r original.pcap -Y "http.request.method == "POST"" -T fields -e tcp.stream

(For illustrative purposes, let's suppose there are 2 matching streams, numbers 1 and 3.)

Second, modify the filter to include the entire stream and save those packets to your file:

tshark -r original.pcap -Y "tcp.stream eq 1 or tcp.stream eq 3 or eapol" -w post.pcap

answered 26 Jul '16, 10:41

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

edited 26 Jul '16, 10:50

Thank you, but I forgot to mention that I want to make a script out of it. Is there a way pass the stream IDs to the filter in the second command automatically?

(27 Jul '16, 12:02) santonline

Below is my attempt at a script that should get you more or less what you want. It can produce either a single .pcapng file with all streams in one file, or it can produce a separate .pcapng file, one for each stream.

#!/bin/sh
# Usage: post.sh <infile> <outfileprefix> [unified]
if [ ${#} -lt 2 ] ; then
echo "Usage: $0 <infile> <outfileprefix> [unified]"
exit 0
fi
infile=${1}
outfile_pfx=${2}
unified=0
if [ ${#} -gt 2 ] ; then
if [ "${3}" == "unified" ] ; then
unified=1
fi
fi
if [ ${unified} -eq 0 ] ; then
for stream in $(tshark -r ${infile} -o wlan.enable_decryption:TRUE -Y "http.request.method==&quot;POST&quot;" -T fields -e tcp.stream | sort -u | tr -d '\r')
do
tshark -r ${infile} -o wlan.enable_decryption:TRUE -Y "tcp.stream eq ${stream} or eapol" -w ${outfile_pfx}-${stream}.pcapng
echo "Wrote ${outfile_pfx}-${stream}.pcapng"
done
else
filter=
for stream in $(tshark -r ${infile} -o wlan.enable_decryption:TRUE -Y "http.request.method == &quot;POST&quot;" -T fields -e tcp.stream | sort -u | tr -d '\r')
do
if [[ -z ${filter}  ]] ; then
filter="tcp.stream eq ${stream}"
else
filter+=" or tcp.stream eq ${stream}"
fi
done
    tshark -r ${infile} -o wlan.enable_decryption:TRUE -Y &quot;${filter} or eapol&quot; -w ${outfile_pfx}.pcapng
    echo &quot;Wrote ${outfile_pfx}.pcapng&quot;

fi

(27 Jul ‘16, 13:55) cmaynard ♦♦