"tshark: someipsd neither a field nor a protocol name"
Code:
def convert_pcap_to_csv_trace(path_to_pcap, tshark_path, output_dir_path=None):
logger.info("***** Converting pcap trace to csv. Trace *****: {}".format(path_to_pcap))
output_dir_path = os.path.dirname(path_to_pcap) if not output_dir_path else output_dir_path
assert os.path.isdir(output_dir_path)
output_file_name = Path(path_to_pcap).stem
path_to_csv = os.path.join(output_dir_path, output_file_name) + '.csv'
logger.info("This might take some time. You can track the progress watching the file size: {}"
.format(path_to_csv))
with open(path_to_csv, 'w') as csv_trace:
cmd = [tshark_path, '-T', 'fields', '-E', 'separator=;',
'-E', 'header=y', '-E', 'quote=d',
'-R', '!someipsd && !icmp && someip.messageid && ((someip.serviceid != 0xffff) && '
'(someip.clientid != 0xdead)) && vlan.id == 0x49',
'-e', 'frame.time_relative',
'-e', 'ip.id',
'-e', 'someip.messageid',
'-e', 'someip.length',
'-e', 'ip.src',
'-e', 'udp.srcport',
'-e', 'tcp.srcport',
'-e', 'ip.dst',
'-e', 'udp.dstport',
'-e', 'tcp.dstport',
'-n', '-r', path_to_pcap]
logger.info("***** Running the following command in command line: *****")
logger.info(cmd)
subprocess.check_call(cmd, stdout=csv_trace)
Above function is working fine in windows 10 local machine. Same above code is not working in VDI windows 10 machine.
what went wrong in VDI (Virtual desktop infrastructure) windows 10 machine?. kindly help me here please.
Can you add the output of
tshark -v
.Looks like SOME/IP Service Discovery Protocol was added in 3.2.0 (
Versions: 3.2.0 to 3.6.7
)My first guess will be that you have no limits imposed on you on you local system but you do have severe limits imposed on you in the VDI. I recommend you get these limitations definded clearly to begin with. VDI's are not your typical workstation that you got used to.
Output:
My local machine and VDI machine having same wireshark V1.10.14 only
On the system that is working, can you modify the function to log the value of
tshark_path
and output oftshark_path -v
? Is it possible that the function is runningtshark
from a different location?Wireshark 1.10.14 is a very old version that was EOL on June 5, 2015.
Can you upgrade to a supported version?