Find in files
Greetings.
I have captured many files of 250MB each for days. Now I have a bit more than 4000 files.
I'd like to find the files where there is a specific flags (0x011). Is there an option where I can "find in files" an expression ?
It will be faster than oppening each file and check with the display filter.
For instance, Notepadd++ has this feature and it's very efficient.
Thanks for your help !
NB : for the next time, I'll set a better capture filter (I just found it). But for this time, I need to retrieve info from the files already cpatured.
Specific flags in which protocol? You can also use the scripting language of your choice and tshark to run the search over multiple files.
Hi Graham, tks for your reply.
flags = tcp.flags=0x011.
if tshark can do this, perfect, what should be the command then ?