Best way to get just one packet

asked 2022-11-28 03:41:52 +0000

leonardus
3 ●1 ●1 ●2

I want to extract some information from a pcap file that was generated without any filter.

But, all I need to extract that info is one frame.

What I'm currently doing is something like this:

good_frame=$(tshark -r file.pcap -Y 'filter expression'  -T fields -e frame.number | head -n1)
tshark -r file.pcap -Y 'frame.number=="$good_frame"' -T fields -e desired.field1 -e desired.field2

Is there a better way to do it?

I was thinking something like:

tshark -r file.pcap -Y 'filter expression' -c 1 -w - | tshark - -T fields -e desired.field1 -e desired.field2

edit retag flag offensive close merge delete

Comments

But, all I need to extract that info is one frame.

How do you determine that frame number? Is it the first frame in the file that matches some filter expression, as you "What I'm currently doing" example suggests?

Guy Harris ( 2022-11-28 05:56:37 +0000 )edit

Correct. I'll filter for one protocol to find out whether that particular pcap file contains it. Then if it does, I get the first frame and work with that.

leonardus ( 2022-11-30 02:38:21 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2022-11-28 17:54:01 +0000

André

176 ●63 ●3

You can use the option -c for count in combination with a read filter, options -2R, to filter out only the first hit on the filter. Thus:

tshark -r file.pcap -2R 'filter expression' -c 1 -T fields -e desired.field1 -e desired.field2

The reason is that a read filter causes the frame numbers to be renumbered. So frame number 1 contains the first hit.

Using a display filter like this -Y 'filter expression' -c 1 only works if the first packet in the capture file happens to match the filter, because the -c limits the amount of packets read from the file.

This and other tricks is shown in the tshark sessions at https://sharkfesteurope.wireshark.org...