Ask Your Question
0

How to combine two filter in tshark

asked 2020-04-14 15:15:50 +0000

alajeb gravatar image

I want to combine two filter in a tshark command to extract the type of the TLS record so I tried this command but iy dosen't work. tshark -r capture.pcapng -T fields -e "tls.record.content_type && tls.record.opaque_type" -E separator="|"

Any help please?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-04-14 15:21:20 +0000

grahamb gravatar image

-e is not a filter, that's an output field selector. To filter (using display filter syntax use -Y, e.g.

tshark -r capture.pcapng -Y "tls.record.content_type && tls.record.opaque_type" -T fields -e "tls.record.content_type -e tls.record.opaque_type" -E separator="|"

Note that this display filter will only select records that have both fields present.

edit flag offensive delete link more

Comments

Is it possible to select tls.record.content_type and tls.record.opaque_type if they were both present or just one and put them always in the same field. I want my final output to be like this (I want to select other fields like record length ...) tls.record.content_type and/or tls.record.opaque_type | tls.record.length | tls.record.version Is it possible?

alajeb gravatar imagealajeb ( 2020-04-14 15:36:30 +0000 )edit

Nope. Each field must be specified separately and will have your choice of separator delimiting them. Combining fields is left to post processing using whatever tools you have to hand.

Wireshark (or tshark) does not support calculated fields directly, but this could be done by writing a post-dissector, probably in Lua.

grahamb gravatar imagegrahamb ( 2020-04-14 15:44:36 +0000 )edit

Could you explain more please Lua

alajeb gravatar imagealajeb ( 2020-04-14 15:47:17 +0000 )edit

Lua is a scripting language built-in to Wireshark that can be used for a range of things such as dissectors, post-dissectors, taps and UI elements.

For your particular case a post-dissector would be created that would combine the 2 fields into a new field that can be selected by -e.

If you have any further questions about Lua, please open a new question.

grahamb gravatar imagegrahamb ( 2020-04-14 16:21:16 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-04-14 15:15:50 +0000

Seen: 64 times

Last updated: Apr 14