Ask Your Question

Tshark filter IP and Port + save in pcapng format

asked 2020-07-13 07:10:38 +0000

sina gravatar image

updated 2020-07-13 07:14:14 +0000

Hello I've to Write a simple script for sniffing packet exchange between a server (windows server) and a camera. I just offered them to use wireshark. But my customer insist to use script. so i wrote a batch file and it supposed to work with tshark. but it doesn't work correctly. here is my script:

tshark -D
set /p interface="Select The Interface: "
set /p IP="Type Camera IP Address: "
set /p Port="Type Camera Port Number: "
tshark -p -n -i %interface% -a duration:100  -Y "ip.dst==%IP% && (tcp.dstport==%Port% || udp.dstport==%Port%)"  -w test.pcapng

I know the filters I'm using are display filters. but even without them I can not save in pcapng Format. also I tried tried -F pcapng and Script is running with administrator privileges . but it's not working. can anybody help me to fix this?! I apologize, my question is elementary but: How can I filter IP and Port in tshark, and save it to a pcapng file!? Conider i'm using it in windows. Any help is valuable for me.

edit retag flag offensive close merge delete


Can you describe "what's not working"? An error, no saved capture file, capture file doesn't include expected traffic?

grahamb gravatar imagegrahamb ( 2020-07-13 09:58:18 +0000 )edit

thanks grahamb. when I run above command, I get this: "tshark: Display filters aren't supported when capturing and saving the captured packets." And when I run it without filters, Nothing saves. Just a number increases on the console

sina gravatar imagesina ( 2020-07-13 10:09:31 +0000 )edit

And when I run it without filters, Nothing saves. Just a number increases on the console

I.e., you run a command such as

tshark -p -n -i %interface% -a duration:100 -w test.pcapng

and, even though the number increases on the console (that's counting the number of packets it captures, which is also the number that it should have saved to the file), there are no packets in the test.pcapng file?

Guy Harris gravatar imageGuy Harris ( 2020-07-14 07:25:37 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-07-13 11:54:29 +0000

grahamb gravatar image

You should convert your display filters to capture filters, e.g.

tshark -p -n -i %interface% -a duration:100  -f "host %IP% and dst port %PORT%"  -w test.pcapng

Note that this filter will only capture traffic to the specified port which may be only one half of the expected traffic, you may need to change the port filter to capture traffic to and from the port, if so simply remove the dst part.

edit flag offensive delete link more


Thank you. My filter problem solved with your answer. also saving problem wasn't from tshark. The main Script Changed Directory multiple time and file saves in different path.

sina gravatar imagesina ( 2020-07-14 05:56:50 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-07-13 07:10:38 +0000

Seen: 1,349 times

Last updated: Jul 13 '20