tshark…can I do the following

Question

I use tshark to capture a group of packets. I'd like to use tshark a second time to:

1) look at a specific packet number

2) return the bytes in the data field (the actual textual response to an http query) to a file as text.

Can I issue a single tshark command that does both things ??

thanks, wk

Answer 1

Hi wk,

To filter a specific packet number, you can use the -R option to set a display filter like the following where X is the packet you want.

tshark -r <infile> -R frame.number==X

Are you looking for the server response to an HTTP request? That is available with the following:

tshark -r <infile> -R frame.number==X -T fields -e http.response.code -e http.response.phrase

Getting back the full HTTP data response isn't as easy since the payload may be split over multiple packets. You can get back the TCP.data layer, but that will also contain any HTTP headers in the packet. Also the output seems to be only in Hex.

tshark -r <infile> -R frame.number==X -T fields -e tcp.data

Hope this helps somewhat, I'm not sure if the whole HTTP response can be pulled out of tshark easily.

Answer 2

You can also use the "-V" option of tshark like this:

tshark -r file.cap -R http -V

This will give you full dissection on all protocols. You can restrict full dissection to only HTTP by adding "-O http".

Hope this helps...