I want to read a pcap file packet per packet and I didn't figure out how to do this. For example, I want to take the first packet in the pcap apply the filter tls.record.length to read it TLS record length and if this length is equal to a value append it to a list. I want to do this with a script. Any help please?
Use tshark and supply options such as -T fields -e FieldYouWant1 -e FieldYouWant2 ... to give csv output. You can have as many -e fieldname arguments as you need. Note that if the field isn't present in a packet you will get a blank.
The output can be processed by the script language of your choice.
Asked: 2020-04-13 09:40:25 +0000
Seen: 278 times
Last updated: Apr 13 '20
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
