This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Cannot use `whois` with `tshark`

0

I am unable to get the orgname or whois output with tshark.

The commands

  1. tshark -lq -T fields -e whois.answer
  2. tshark -lq -T fields -e ip.geoip.src_org

Give me a empty lines.

Why is it so?

asked 08 Oct '16, 10:03

user31415's gravatar image

user31415
26●5●6●9
accept rate: 0%

Are you attempting to run tshark on a previous capture or a live capture as you don't seem to be providing either a file to read or an interface to capture on? By default, with no file or interface specified, tshark will attempt to capture on some interface which may not be what you intend.

In either case, are you sure the file or live capture traffic contains the fields of interest?

(08 Oct '16, 10:46) grahamb ♦

Can you provide an example that works for you? I tried tshark -i wlp3s0 -lq -T fields -e ip.dst -w output then tshark -lq -T fields -e whois.answer -r output. I only have blank lines. Same thing for any whois fields listed in tshark -G.

(09 Oct '16, 03:26) user31415

It can also be linked to my OS, I am using Ubuntu 16.04

(09 Oct '16, 03:33) user31415

Are you sure you have whois traffic in your capture? If I capture whois traffic then the field whois.answer produces the expected results.

To get results from the ip.geoip.src_org field you must also have configured up geoip lookups in the Wireshark preferences (i.e. downloaded a database).

Try loading your capture in Wireshark and using a display filter of "whois" to see if you do have whois traffic.

(09 Oct '16, 04:30) grahamb ♦