 | 1 | initial version |
Example file: telnet-cooked.pcap from the Wireshark wiki Sample Captures
Documentation available in User's Guide (Following Protocol Streams) and the tshark man page.
ask_wireshark$ tshark -r telnet-cooked.pcap -T fields -e tcp.stream | sort -n | uniq
0
ask_wireshark$
ask_wireshark$ tshark -r telnet-cooked.pcap -z follow,tcp,hex,0 -q
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 192.168.0.2:1550
Node 1: 192.168.0.1:23
00000000 ff fd 03 ff fb 18 ff fb 1f ff fb 20 ff fb 21 ff ........ ... ..!.
00000010 fb 22 ff fb 27 ff fd 05 ff fb 23 ."..'... ..#
00000000 ff fd 25 ..%
0000001B ff fc 25 ..%
00000003 ff fb 03 ff fd 18 ff fd 1f ff fd 20 ff fd 21 ff ........ ... ..!.
00000013 fd 22 ff fa 22 01 0b ff f0 .".."... .
0000001E ff fa 1f 00 50 00 20 ff f0 ff fa 22 03 01 00 00 ....P. . ..."....
0000002E 03 62 03 04 02 0f 05 00 00 07 62 1c 08 02 04 09 .b...... ..b.....
0000003E 42 1a 0a 02 7f 0b 02 15 0f 02 11 10 02 13 11 00 B....... ........
0000004E 00 12 00 00 ff f0 ff fd 03 ff fa 22 01 0f ff f0 ........ ..."....
0000001C ff fd 27 ff fb 05 ff fd 23 ff fb 26 ff fd 26 ff ..'..... #..&..&.
0000002C fd 24 .$
0000005E ff fe 26 ff fc 26 ff fc 24 ..&..&.. $
0000002E ff fa 20 01 ff f0 ff fa 23 01 ff f0 ff fa 27 01 .. ..... #.....'.
0000003E ff f0 ff fa 18 01 ff f0 ........
00000067 ff fa 20 00 39 36 30 30 2c 39 36 30 30 ff f0 ff .. .9600 ,9600...
00000077 fa 23 00 62 61 6d 2e 7a 69 6e 67 2e 6f 72 67 3a .#.bam.z ing.org:
00000087 30 2e 30 ff f0 ff fa 27 00 00 44 49 53 50 4c 41 0.0....' ..DISPLA
00000097 59 01 62 61 6d 2e 7a 69 6e 67 2e 6f 72 67 3a 30 Y.bam.zi ng.org:0
000000A7 2e 30 ff f0 ff fa 18 00 78 74 65 72 6d 2d 63 6f .0...... xterm-co
000000B7 6c 6f 72 ff f0 lor..
00000046 ff fd 01 ...
000000BC ff fc 01 ...
00000049 ff fb 01 ff fa 21 02 ff f0 ff fc 01 .....!.. ....
000000BF ff fd 01 ff fe 01 ......
00000055 ff fa 22 03 05 80 00 11 80 00 12 80 00 ff f0 .."..... .......
00000064 0d 0a 4f 70 65 6e 42 53 44 2f 69 33 38 36 20 28 ..OpenBS D/i386 (
00000074 6f 6f 66 29 20 28 74 74 79 70 32 29 0d 0a 0d 0a oof) (tt yp2)....
00000084 6c 6f 67 69 6e 3a 20 login:
000000C5 66 61 6b 65 0d 0a fake..
<snip>
00000559 24 20 $
00000101 65 78 69 74 0d 0a exit..
===================================================================
ask_wireshark$
Depending on the use, you may want to change the mode to ascii, raw or ebcdic.
| | 2 | No.2 Revision |
Example file: telnet-cooked.pcap from the Wireshark wiki Sample Captures
Documentation available in User's Guide (Following Protocol Streams) and the tshark man page.
ask_wireshark$ tshark -r telnet-cooked.pcap -T fields -e tcp.stream | sort -n | uniq
0
ask_wireshark$
ask_wireshark$ tshark -r telnet-cooked.pcap -z follow,tcp,hex,0 -q
===================================================================
Follow: tcp,hex
Filter: tcp.stream eq 0
Node 0: 192.168.0.2:1550
Node 1: 192.168.0.1:23
00000000 ff fd 03 ff fb 18 ff fb 1f ff fb 20 ff fb 21 ff ........ ... ..!.
00000010 fb 22 ff fb 27 ff fd 05 ff fb 23 ."..'... ..#
00000000 ff fd 25 ..%
0000001B ff fc 25 ..%
00000003 ff fb 03 ff fd 18 ff fd 1f ff fd 20 ff fd 21 ff ........ ... ..!.
00000013 fd 22 ff fa 22 01 0b ff f0 .".."... .
0000001E ff fa 1f 00 50 00 20 ff f0 ff fa 22 03 01 00 00 ....P. . ..."....
0000002E 03 62 03 04 02 0f 05 00 00 07 62 1c 08 02 04 09 .b...... ..b.....
0000003E 42 1a 0a 02 7f 0b 02 15 0f 02 11 10 02 13 11 00 B....... ........
0000004E 00 12 00 00 ff f0 ff fd 03 ff fa 22 01 0f ff f0 ........ ..."....
0000001C ff fd 27 ff fb 05 ff fd 23 ff fb 26 ff fd 26 ff ..'..... #..&..&.
0000002C fd 24 .$
0000005E ff fe 26 ff fc 26 ff fc 24 ..&..&.. $
0000002E ff fa 20 01 ff f0 ff fa 23 01 ff f0 ff fa 27 01 .. ..... #.....'.
0000003E ff f0 ff fa 18 01 ff f0 ........
00000067 ff fa 20 00 39 36 30 30 2c 39 36 30 30 ff f0 ff .. .9600 ,9600...
00000077 fa 23 00 62 61 6d 2e 7a 69 6e 67 2e 6f 72 67 3a .#.bam.z ing.org:
00000087 30 2e 30 ff f0 ff fa 27 00 00 44 49 53 50 4c 41 0.0....' ..DISPLA
00000097 59 01 62 61 6d 2e 7a 69 6e 67 2e 6f 72 67 3a 30 Y.bam.zi ng.org:0
000000A7 2e 30 ff f0 ff fa 18 00 78 74 65 72 6d 2d 63 6f .0...... xterm-co
000000B7 6c 6f 72 ff f0 lor..
00000046 ff fd 01 ...
000000BC ff fc 01 ...
00000049 ff fb 01 ff fa 21 02 ff f0 ff fc 01 .....!.. ....
000000BF ff fd 01 ff fe 01 ......
00000055 ff fa 22 03 05 80 00 11 80 00 12 80 00 ff f0 .."..... .......
00000064 0d 0a 4f 70 65 6e 42 53 44 2f 69 33 38 36 20 28 ..OpenBS D/i386 (
00000074 6f 6f 66 29 20 28 74 74 79 70 32 29 0d 0a 0d 0a oof) (tt yp2)....
00000084 6c 6f 67 69 6e 3a 20 login:
000000C5 66 61 6b 65 0d 0a fake..
<snip>
00000559 24 20 $
00000101 65 78 69 74 0d 0a exit..
===================================================================
ask_wireshark$
Depending on the use, you may want to change the mode to ascii, raw or ebcdic.
Windows 10 has an undocumented unique option:
$ tshark -r telnet-cooked.pcap -T fields -e tcp.stream | sort /unique
0