I would like to save it, but there is an error in this command, do you have any idea about it? asked 01 Aug '17, 06:23  alfrego129 edited 01 Aug '17, 06:33  grahamb ♦ |
One Answer:
You are mixing tshark arguments and another command "grep". You can't do that, you should read up some more on using pipelines to join commands together. Move the grep to the end: answered 01 Aug '17, 06:29 grahamb ♦ edited 01 Aug '17, 06:29 showing 5 of 23 show 18 more comments |
It also looks like you are running tshark as root. Don't do that
Finally, please don't "spam" any other question that might possibly using -T fields with your specific question, that will only get you banned, instead raise a new question for your specific question.
Okey, sorry. "It also looks like you are running tshark as root. Don't do that" why it not proper? Thank you.
See the wiki item on security here.
Basically doing so exposes your system to running lots of code fed by external (possibly malicious) network traffic, all with root privileges and is totally unnecessary.
I used wmware, therefore, feel relax always. Thank you very much, for safe mode, do you recommend any way?
What's the OS you're using?
Kali Linux
What was the initial goal of having grep in the middle of the parameters? Did you intend to filter by contents of
_ws.col.Info?For Kali, try this (untested by me): https://sathisharthars.com/2014/06/04/running-wireshark-with-non-root-user-in-kali-linux/
@sindy, I was trying to extract proper packets for DoS attack then I will implement them on Weka. @grahamb thank you, it is definitely really useful.
I was wondering whether the "sogou" string is only available in the
_ws.col.Infoor whether you can use-Y "frame contains sogou"to fulfil the same goal.@sindy really it works excellent if I want to add features such as ip.dst -e tcp.dstport -e ip.proto -e tcp.flags.syn -e ip.flags how can I implement them on "tshark -r /root/Desktop/a.pcap -T fields -e frame.number -Y "frame contains sogou" >/root/Desktop/veri.csv" ?
I wonder what is the tshark man page lacking that complicates you the understanding of the concept.
tsharktakes a list of command line parameters which have names and in most cases values. So-Y "frame contains sogou"is one parameter whose name isYand whose value is"frame contains sogou"; the quotation marks are there to indicate that the whole string including the spaces is the value of that single parameter.Now some of the parameters make sense only once (
-T,-Y,-r,-w) while others may be repeated as many times as needed if multiple values of that parameter make sense, like-ewhose value is a name of protocol field to show in the output and only makes sense if value of-Tisfields, or like-iwhich indicates from which interface to capture as you can capture from several interfaces simultaneously.So in particular, you can add
-e ip.dst -e tcp.dstport -e ip.proto -e tcp.flags.syn -e ip.flagsright after-e frame.numberand you should get these fields in the output.Also important, there is no mandatory relationship between the field names used in display filter and field names listed using
-eto be printed in the output - you can display-filter by some group of protocol fields and actually print a completely different group of protocol fields.Yes, I have read man page. Thank you very much for all information, definitely, they were too useful.
@grahamb I would like to ask a question, however, due to your spam warning, I cannot ask, I did not know the rule of the forum and have been learning them. Thank you.
You have misunderstood @grahamb. There is nothing bad on asking a new Question - provided that you don't ask the same thing you've already asked before, only in different words. What he had in mind was that you have placed a comment to an already answered, loosely related question, instead of asking a separate Question pinpointed to your particular issue.
Okey, but I have tried to ask a question today and saw it;
"Akismet believes your question is spam. We're sorry, but Akismet believes your question is spam. If you believe this is an error, please contact the forum administrator. "
How can I fix this situation?
This is a known problem, already reported as Bug 13714. So far, there is no solution, partly because I don't think the cause is clear.
You could try re-wording your question or leaving out most text when creating it then try editing it afterward.
In your case, I wonder if it's possible that because you awarded all of your reputation points to @grahamb that it's causing a problem for users with 0 reputation?
You can easily check whether @cmaynard is right regarding the 0 reputation as a cause. If you consider @grahamb's Answer to which this Comment belongs a correct one to your Question (I do but the decision is yours), click the checkmark icon next to it. Doing so awards some reputation points not only to @grahamb but also to you. And then you can try to ask a new Question again.
@alfrego129,
By devious means I have returned the 10 points you awarded me, try posting your question now. Also take note of @sindy's comment on accepting my answer.
Thank you @grahamb
@alfrego129, I've removed your last few comments as they really were related to your other question and had no place here.
@alfrego129, if an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.