Dear All, I want to split captured traffic based on the delay between packet. so that if the the delay between two packet is more than the threshold, save the trace in new file. How can I do it using tshark commands? Edit1: here is the code I use for splitting traffic based on Sindy's answer:
And use Sindy's MATE configuration with just changing the delay time. But while loop didn't stop. should I use other option to check whether .pcapng file is empty or not? |
If I get you right and you want to create a new file each time the pause between packets is longer than the threshold, it cannot be done while capturing. MATE could be a way to mark all frames belonging to the same "burst" with a unique numeric ID ( An example of MATE configuration with a gap threshold of 0.01 second follows:
Thanks for your reply, I want to do it after capturing, while reading traffic using -r and other filtering options in my processing phase. Is there other solution?
(03 Sep '16, 03:37)
Zahra
Well, I've already described the suggestion as only applicable in the post-processing mode, so I'm not sure whether I get your reaction properly. If you want to split the capture into parts up to the gaps between frames only after applying your display filter, I'm afraid you would have to use two instances of tshark in a chain. Tshark does support an idea of a separate "read filter" and "display filter" which use the same syntax but serve a different purpose, yet the two-pass mode of tshark which is currently mandatory for use of read filter has some trouble with MATE. But you may give it a try:
If it does not work, you have to revert to the chain method:
But it may not be possible on Windows.
(03 Sep '16, 03:51)
sindy
Sorry I didn't try MATE before, how should I add MATE configuration to my bash script. In https://wiki.wireshark.org/Mate/GettingStarted wasn't any explanation for do it in ubuntu and also in bash script. Could you plz help me in this?
(03 Sep '16, 09:02)
Zahra
1
tshark shares a common preferences file with Wireshark, so you can use Wireshark's GUI to set the MATE configuration file. But you can use
(03 Sep '16, 11:47)
sindy
thanks, now tshark works fine, but there is a problem about check file is empty or not?
(03 Sep '16, 13:09)
Zahra
1
The thing is that for a pcap or pcapng file, "empty" means "contains no frames", not "has zero size", so Google of "file size bash" returns links to several Q&A sites with sophisticated answers; I would myself use
(03 Sep '16, 23:34)
sindy
in my case empty pcapng file is 380, is there any differences by case?
(03 Sep '16, 23:55)
Zahra
1
I haven't analysed it deeply, but it depends on what tshark writes to the file at start. If the interface description(s) are written, the resulting size depends on the interface name(s) which are strings whose size depends on the environment. Just for the fun of it, can you post your empty pcapng file? It seems that tshark has no option allowing to easily evaluate emptiness of a file, nor the manual says anything about a return code. So to make the script portable, you may have to use a never matching display filter like
(04 Sep '16, 00:16)
sindy
thanks, here is my empty .pcapng file. http://s000.tinyupload.com/?file_id=03339871074200476632
(04 Sep '16, 00:31)
Zahra
1
OK, so the size of an "empty" pcapng really depends on a lot of factors, not just on the environment where tshark runs.
(04 Sep '16, 01:04)
sindy
showing 5 of 10
show 5 more comments
|