I want to use Tshark to do TCP stream assembly .But I can only find the command in user's guide. “tshark -r pcapfile tcp.stream > outfile.txt” "tshark -r pcapfile conv.tcp"> outfile.txt But I want to follow all tcp conversations and split the tcp stream in the same conversation into different files.What should I do? eg: tcpconversation1.txt, includes the whole tcp streams in the tcp conversations.
For your posted python issue, try adding a space between the tcp stream index and the output redirection operator ">", i.e.
#!usr/bin/python
import os
for m in range(14):
print("tshark -r data/aim_chat_3a.pcap tcp.stream eq %i >data/%i.txt" %(m, m))
os.system("tshark -r data/aim_chat_3a.pcap tcp.stream eq %i >data/%i.txt" %(m, m))
You can add a display filter to only output packets that are sent from a to b or from b to a, e.g.
-Y ((ip.src == a) && (ip.dst == b)) || ((ip.src == b) && (ip.dst == a))
if you need to make sure only tcp packets are included, then append an additional filter element for tcp, e.g.
&& tcp
I'm not just want the only one tcp conversation between a and b.I also want the conversation between b and c, c and e ....I want all conversations in the packets. We can use the filter in wireshark " tcp.stream eq 0", then we will get all the packets in this conversation 0 and export it to the file tcpconversation0.txt. And when we use the filter " tcp.stream eq 1", we can export tcpconversation1.txt. But it's slow when the packet in huge and complication if I get tcpconversation*.txt by change the num in "tcp.stream eq num" , I also don't know the exactly numbers how many conversations in the packet. So please tell me how can I achieve by Tshark?
You can't directly do what you want. A tcp stream only consists of traffic between the same two hosts, so will only be a & b.
Is there some other specific way to describe the traffic you want to output, using tcp stream index doesn't really seem to be what you're wanting?
Asked: 2018-01-22 13:45:41 +0000
Seen: 7,777 times
Last updated: Jan 22 '18
Can you expand on your question a bit? Do you want the output file to contain all the packets from tcp steam 0, followed by tcp stream 1, etc., or do you want each stream in a separate file, e.g. tcp stream 0 in tcpconversation0.txt, etc.
Thanks for your question.I want the tcp streams in the same conversation in the same file. Suppose there is a conversation between a & b, there are ten tcp streams in the conversation, I want the ten tcp streams in the same file.
code：
Sorry,I really don't know how to put the code with format.
output:
(more)