pyshark for live capture - dumpcap and tshark

asked 2021-02-10 07:12:34 +0000

1 ●10 ●18 ●21

updated 2021-02-11 16:52:42 +0000

Hello,

When using tshark it creates temporary files. When it is used for long time, it will create huge files, therefore it is a good idea to limit the size and number of files.

From reading in the internet, when starting tshark, it will automatically use dumpcap.

Now, I'd like to use pyshark to capture the data and import it to python for further analysis. pyshark uses 2 tools (dumpcap and tshark) as follows:

dumpcap -q -i 5 -w -
tshark -l -n -T pdml -r - -b filesize:1024 -b files:1 -w /tmp/pyshark.cap -P

the outfile, format of text output, ring buffer parameters could be changed with the existing interface of pyshark.

However, If I'd like to use display filter (with -Y) or capture filter (-f) I'm getting Multiple capture files requested, but a capture isn't being done which is tshark`s message

What change do you suggest to do so that live capture could be used with capture filter and/or display filter?

EDIT:

I've tested the proposed change below:

dumpcap -q -f length ==162 -i 2 -w - 
tshark -l -n -T pdml -r - -b filesize:1024 -b files:1 -w /tmp/pyshark.cap -P

and still receiving Multiple capture files requested, but a capture isn't being done

What I'm doing wrong?

Comments

What is the complete command line being passed when adding the display or capture filters?

grahamb ( 2021-02-10 09:10:17 +0000 )edit

For example

tshark -l -n -T pdml -Y udp.port==30000 -r - -b filesize:1024 -b files:1 -w test.pcap -P

BMWE ( 2021-02-10 09:15:38 +0000 )edit

add a comment

answered 2021-02-10 17:45:17 +0000

Chuckc
3023 ●6 ●608 ●20

When using the -r option, tshark is not in capture mode so capture options are not allowed.

If you want to rotate test.pcap, use -w - and pipe to "magic code here".

dumpcap has a -f <capture filter> option that can limit the data captured and sent to tshark.

tshark man page
-r|--read-file <infile> - Read packet data from infile, ...

tshark.c

      /*
       * "-r" was specified, so we're reading a capture file.
       * Capture options don't apply here.
       */

edit flag offensive delete link

Comments

OK, so according to my understanding, I shall change the code so that the capture filter (or display filter) would be on dumpcap and use the tshark regularly as on my question. Am I understanding right?

BMWE ( 2021-02-10 17:52:45 +0000 )edit

Yes with the caveat that dumpcap only supports capture filters.

Chuckc ( 2021-02-10 18:47:02 +0000 )edit

So if I have some custom dissector with 6 types of messages, how can I filter specific message? Lets say the protocol name is my_protocol and contains message setum_cmd and status_rpt. I'd like to filter one of them. How my command shall look like? (never did it)

BMWE ( 2021-02-10 18:50:51 +0000 )edit

Sorry. I forgot to add in to use the display filter on tshark:

C:\>dumpcap -q -i 6 -w - | tshark -l -n -r - -w test.pcap -P -Y icmp
Capturing on 'Ethernet'
File: -
   71   5.404530 192.168.200.135 8.8.8.8      ICMP 98 eth:ethertype:ip:icmp:data            1 (0x0001) 256 (0x0100) 8960 (0x2300),35 (0x0023)    Echo (ping) request  id=0x0023, seq=1/256, ttl=128
   72   5.473056      8.8.8.8 192.168.200.135 ICMP 98 eth:ethertype:ip:icmp:data            1 (0x0001) 256 (0x0100) 8960 (0x2300),35 (0x0023)    Echo (ping) reply    id=0x0023, seq=1/256, ttl=118 (request in 71)

Chuckc ( 2021-02-10 20:02:51 +0000 )edit

Mr. @Chuckc, your last comment is not answering the issue. The example you have provided is working as there is no -b flag I need the -b flag as part of the tcpdump and there the filter won't work. Can you please refer to my last comment?

BMWE ( 2021-02-10 20:10:35 +0000 )edit

see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

pyshark for live capture - dumpcap and tshark

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

pyshark for live capture - dumpcap and tshark edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

pyshark for live capture - dumpcap and tshark