There is a pcap file on my disk ,I want to print it on my console by using rawshark, but receive this "rawshark: Input file or pipe name not specified".
My command is like this: ./rawshark -s ./f1528 -d encap:EN10MB
Usage: rawshark [options] ...
Input file:
-r <infile> set the pipe or file name to read from
Are you missing -r ?
Ah, so rawshark is intended to provide 'realtime' processing of a data stream. Therefore it's not geared to reading already existing capture files. That is just old data. You'll have to feed it otherwise.
One way to do this is using a pipe, like so (reading from stdin):
cat ./f1528 | ./rawshark -s -r - -d encap:EN10MB
Another way it to use a FIFO (in the file system), like so:
mkfifo sharkfin
cat ./f1526 > sharkfin
while in another process (another shell):
./rawshark -s -r sharkfin -d encap:EN10MB
You may want to add some -F options too, to get some field data.
Asked: 2018-05-01 13:21:09 +0000
Seen: 1,663 times
Last updated: May 01 '18
