Comparing TShark & Wireshark "Follow Stream"

edit

The tshark.dat file is actually a pcapng file containing the matching packets of the given tcp filter; it's not the same as the follow TCP stream output of Wireshark at all, which only contains the relevant stream's TCP payload data.

Maybe this is more what you're looking for?

C:\Program Files\Wireshark\tshark.exe -q -nr D:\pcap\test\output_0932.pcap -z follow,tcp,ascii,0 -Y tcp -w tshark.dat

... and if you want to eliminate the extraneous information at the top, then you can use tail -n +x to do that, where x is the line you want to start with, thus eliminating the x-1 previous lines. For example:

C:\Program Files\Wireshark\tshark.exe -q -nr D:\pcap\test\output_0932.pcap -z follow,tcp,ascii,0 -Y tcp | tail -n +9 > tshark.dat

... and since you're on Windows, if you don't have Cygwin installed, and thus you don't have tail at your disposal, then you should be able to accomplish the same thing (more or less) with PowerShell commands. For example:

C:\Program Files\Wireshark\tshark.exe -q -nr D:\pcap\test\output_0932.pcap -z follow,tcp,ascii,0 -Y tcp | powershell -noninteractive -noprofile -c "$input | Select-Object -Skip 8" > tshark.dat

... and if you want to remove the blank lines:

C:\Program Files\Wireshark\tshark.exe -q -nr D:\pcap\test\output_0932.pcap -z follow,tcp,ascii,0 -Y tcp | powershell -noninteractive -noprofile -c "$input | Select-Object -Skip 8 | ? {$_.trim() -ne \"\" }" > tshark.dat