This is our old Q&A Site. Please post any new questions and answers at

Hi, I need to export the data from my capture. I am aware of follow the stream, save as. It works fine for small captures. If the capture is big this operation will never end. Can this operation be done as the batch? I hope for better performance.. If yes, can you advise the exact command and parameter? thx Bob

asked 13 Dec '16, 13:23

cz50344's gravatar image

accept rate: 0%

You may want to check out the tshark option -z follow. For example to follow TCP stream 1 and store the raw data you could run tshark -z follow,tcp,raw,1 [-r /path/to/file]. Check out the tshark man page for details.

permanent link

answered 04 Jan '17, 06:31

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%


it is almost perfect answer. Thanks for it.

Now - Can we extract only one direction? I have tried this, but it does not work. I am not able to filter for only one direction.

tshark -z follow,tcp,raw,((ip.src eq and tcp.srcport eq 39647) and (ip.dst eq and tcp.dstport eq 2501)) -r qsysprt.trccnn.cap -w oout.pcl



(04 Jan '17, 09:21) cz50344

The filter in this case is there to select the stream not to select the direction. I think you'll need to post-process the data using the fact that, as the man page says: The data sent by the second node is prefixed with a tab to differentiate it from the data sent by the first node.

BTW, don't forget to accept the answer (if it answers your question) by clicking on the checkbox next to it--see the FAQ for details.

(04 Jan '17, 10:06) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 13 Dec '16, 13:23

question was seen: 1,131 times

last updated: 04 Jan '17, 10:06

p​o​w​e​r​e​d by O​S​Q​A