[LINUX] Parse pcap data with tshark command

[1. What is the tshark command](What is the #tshark command) 2. Preferences [3. Execute](# Execute) [4. How to filter pcap files](# How to filter pcap files) [5. Option](# Option) [6. Reference](# Reference)

What is the tshark command?

It is possible to execute Wireshark with CLI. Since it is a CLI, it will be quite easy for CLI craftsmen to handle pcap data such as parallel processing, writing in shell scripts, cron, grep, etc.!

Environmental setting

In this article, I'm trying it on MacOS. First, make tshark available on your Mac. It can be done from either GUI or CLI.

** When installing with GUI (from the Web) ** You can install it from the following.  https://www.wireshark.org/download.html

** When installing with CLI (terminal) **


 brew install wireshark


Let's do it right away! This time we will look at the data called test.pcap.


 tshark -r test.pcap

You should now be able to confirm the contents of the data. By the way, the order of data and the displayed items are in the default state, but you can specify the data you want to check and the display order. Even if you change the display of columns with Wireshark in the GUI, it will be affected by the result of the tshark command.

How to filter pcap files

This time, filter with the following conditions and try again. conditions () Filters that can be used with normal WireShark (GUI) ・ Focus on smb2 protocol communication    smb2.tree && tcp.dstport==445 -Remove extra communication where the file name or account name is missing.    smb2.filename != "" && smb2.acct != "" display () How to write columns that can be used with normal WireShark (GUI) ·account name    smb2.acct ・ Folder path (shared path)    smb2.tree -Operation file name    smb2.filename ・ The name of the terminal you are accessing    smb2.host


 tshark -r test.pcap -T fields -e smb2.acct -e smb2.tree -e smb2.filename -e smb2.host -Y 'smb2.tree && tcp.dstport==445 && smb2.filename != "" && smb2.acct != ""'

Of course, it is also possible to convert to data that can be easily handled using pipes and redirects as shown below.


 tshark -r test.pcap <optional system>| grep -i test
 tshark -r test.pcap <optional system>> test.csv


option Contents
-i <interface> Specify the interface to capture
-f <capture filter> libpcap filter Specify a filter by syntax
-s <snaplen> Specify snapshot length (default: 65535)
-p Do not use promiscuous mode
-y <link type> Specify link layer type (default: first appropriate)
-D Show interface list
-L Show interface link layer type list
-c <packet count> Stop at the specified number of packets (default):infinite)
-a <autostop cond.> ・ Duration:NUM
Stops after the number of seconds specified by NUM has elapsed
・ Filesize:NUM
Size specified by NUM(KB)Stop when the saved file reaches
・ Files:NUM
Stop when the number of saved files specified by NUM is reached
-b <ringbuffer opt.> ・ Duration:NUM
Save to the next file after the number of seconds specified by NUM has elapsed
・ Filesize:NUM
Size specified by NUM(KB)When the save file reaches, save to the next file
・ Files:NUM
Replace files when the number of saved files specified by NUM is reached
-r <infile> Read from packet file
R <read filter> Specify Wireshark display filter
-n Disable all name resolution(Default:Effectiveness)
-N <name resolve flags> Enable specific name resolution
-d <layer_type>==<selector>,<decode_as_protocol> Associate a specific port with a specific protocol
tcp.port==8888,For http
"Tcp port 8888 is http"
-C <config profile> Specify the configuration file
-F <output file type> Specify output file type
-V Add packet tree to display
-S [-w]Show packets even if the option is enabled
-x Added hex, ASCII dump display
-e <field> Specify the field you want to output


How to install Homebrew tshark option memo

Recommended Posts

Parse pcap data with tshark command
[Linux command] Petit data analysis with grep / awk / sort command
Visualize data with Streamlit
Reading data with TensorFlow
json parse with gdb
Parse XML in Python
json parse with gdb
Generate XML (RSS) with Python
Process feedly xml with Python.
Parse pcap data with tshark command
Process Pubmed .xml data with python
Data visualization with pandas
Data manipulation with Pandas!
Shuffle data with pandas
Data Augmentation with openCV
Normarize data with Scipy
Data analysis with Python
LOAD DATA with PyMysql
Sample data created with python
Embed audio data with Jupyter
Graph Excel data with matplotlib (1)
Artificial data generation with numpy
Get Youtube data with python
Clustering ID-POS data with LDA
Learn new data with PaintsChainer
Binarize photo data with OpenCV
Graph Excel data with matplotlib (2)
Save tweet data with Django
Data processing tips with Pandas
Interpolate 2D data with scipy.interpolate.griddata
Encryption / decryption with GPG command
Read json data with python