How do I use a filter expression, such as "frame contains ..." or "tcp contains ..." in tshark?

asked 2020-12-06 15:44:03 +0000

moraist
9 ●2 ●7 ●8

updated 2020-12-06 20:39:22 +0000

Guy Harris
19890 ●3 ●633 ●207

Hi Guys,

I am trying to use the same options "frame contains XXXX" and "tcp contains XXXX" in the tshark, but I can't do that. These options are available in the tshark? How I can do that?

Comments

What options did you try? Did you consult the manual page?

Jaap ( 2020-12-06 16:35:40 +0000 )edit

add a comment

answered 2020-12-06 16:53:27 +0000

Chuckc
2818 ●5 ●567 ●19

$ tshark -r ./ultpcap2.pcapng -Y "frame contains \"http\""  | wc
    105    1589   16286

$ tshark -r ./ultpcap2.pcapng -Y "tcp contains \"http\""  | wc
     59     802    7940

The search string needs double quotes that are "escaped" since the string passed to -Y also needs quotes.
Brief discussion here in a question about tshark.

edit flag offensive delete link

Comments

The escaping, and\or quoting depends on the shell, e.g. for PowerShell (on Windows at least) you can mix single and double quotes, e.g. ... -Y "frame contains 'http'". The PowerShell escape is the backtick, so it could also be written ... -Y "frame contains `"http`".

grahamb ( 2020-12-06 19:42:58 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

How do I use a filter expression, such as "frame contains ..." or "tcp contains ..." in tshark?

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

How do I use a filter expression, such as "frame contains ..." or "tcp contains ..." in tshark? edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

How do I use a filter expression, such as "frame contains ..." or "tcp contains ..." in tshark?