This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

If tshark can support “export objects” like wireshark for GUI

0

Dear All.

I have a question about tshark. Could you explain me why tshark doesn't support "export objects" like wireshark? I couldn't find anything comment related to my question. Please, advice me.

Thank you

asked 13 Nov '13, 11:59

honeycap78's gravatar image

honeycap78
1111
accept rate: 0%


2 Answers:

1

Could you explain me why tshark doesn't support "export objects" like wireshark? I

because nobody had the time and/or interest to implement that feature yet.

If the "export objects" feature in GUI does not work for you (because you want to automate it), there are other (CLI) tools.

http://code.google.com/p/nfex/
https://isc.sans.edu/diary/Tools+for+extracting+files+from+pcaps/6961

Maybe one of those will help you.

Regards
Kurt

answered 14 Nov '13, 04:22

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

1

As of Wireshark 2.3.0, you can export HTTP objects with tshark. (Wireshark 2.3.0 hasn't been released yet, so you can grab a daily build from here.)

To extract HTTP objects from the command-line, run the following command:

tshark -r mypcap.pcap --export-objects "http,destdir"

answered 15 Dec '16, 16:52

moshe's gravatar image

moshe
21125
accept rate: 0%