Ask Your Question

Best way to get just one packet

asked 2022-11-28 03:41:52 +0000

leonardus gravatar image

I want to extract some information from a pcap file that was generated without any filter.

But, all I need to extract that info is one frame.

What I'm currently doing is something like this:

good_frame=$(tshark -r file.pcap -Y 'filter expression'  -T fields -e frame.number | head -n1)
tshark -r file.pcap -Y 'frame.number=="$good_frame"' -T fields -e desired.field1 -e desired.field2

Is there a better way to do it?

I was thinking something like:

tshark -r file.pcap -Y 'filter expression' -c 1 -w - | tshark - -T fields -e desired.field1 -e desired.field2
edit retag flag offensive close merge delete


But, all I need to extract that info is one frame.

How do you determine that frame number? Is it the first frame in the file that matches some filter expression, as you "What I'm currently doing" example suggests?

Guy Harris gravatar imageGuy Harris ( 2022-11-28 05:56:37 +0000 )edit

Correct. I'll filter for one protocol to find out whether that particular pcap file contains it. Then if it does, I get the first frame and work with that.

leonardus gravatar imageleonardus ( 2022-11-30 02:38:21 +0000 )edit

2 Answers

Sort by » oldest newest most voted

answered 2022-11-28 17:54:01 +0000

André gravatar image

You can use the option -c for count in combination with a read filter, options -2R, to filter out only the first hit on the filter. Thus:

tshark -r file.pcap -2R 'filter expression' -c 1 -T fields -e desired.field1 -e desired.field2

The reason is that a read filter causes the frame numbers to be renumbered. So frame number 1 contains the first hit.

Using a display filter like this -Y 'filter expression' -c 1 only works if the first packet in the capture file happens to match the filter, because the -c limits the amount of packets read from the file.

This and other tricks is shown in the tshark sessions at

edit flag offensive delete link more


Reading the documentation for -2 and -R, this makes a lot of sense. Thanks.

leonardus gravatar imageleonardus ( 2022-11-30 02:44:19 +0000 )edit

answered 2022-11-28 05:34:37 +0000

7ACE gravatar image

tshark -r file.pcap -Y 'filter expression' -c 1 -T fields -e desired.field1 -e desired.field2

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2022-11-28 03:32:58 +0000

Seen: 774 times

Last updated: Nov 28 '22