Ask Your Question
0

tshark export data with epoch time

asked 2023-06-08 08:41:02 +0000

BMWE gravatar image

updated 2023-06-08 09:00:34 +0000

Hi,

I'm trying to read file and save content to text file with epoch time. I'm executing : tshark -r filename.cap -t e -F k12text -w tmp.txt, however the exported time stamp is utc time.

Please assist.

Tshark version 3.4.0

edit retag flag offensive close merge delete

Comments

Can you update the question with the output of tshark -v.

Chuckc gravatar imageChuckc ( 2023-06-08 08:58:21 +0000 )edit

appended :)

BMWE gravatar imageBMWE ( 2023-06-08 09:01:03 +0000 )edit

Thanks! I'm seeing the same thing with 4.0.6. Will look at code to see why.

Chuckc gravatar imageChuckc ( 2023-06-08 09:04:39 +0000 )edit

Does it has to be k12text?
Otherwise you can use this way to extract the epoch time and only the other fields you require:
tshark -r filename.cap -T fields -e frame.time_epoch -e ...

André gravatar imageAndré ( 2023-06-08 20:00:14 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2023-06-08 09:23:42 +0000

Chuckc gravatar image

updated 2023-06-08 09:30:10 +0000

-t only affects the timestamp in the summary lines.

~$ tshark -r ./tcptst_out.pcap
    1   0.000000 104.18.91.105 192.168.200.135 TCP   443 → 18082 [FIN, ACK] Seq=1 Ack=1 Win=68 Len=0

~$ tshark -r ./tcptst_out.pcap -t e
    1 1592016429.488229 104.18.91.105 192.168.200.135 TCP   443 → 18082 [FIN, ACK] Seq=1 Ack=1 Win=68 Len=0

~$ tshark -r ./tcptst_out.pcap -t u
    1 02:47:09.488229 104.18.91.105 192.168.200.135 TCP   443 → 18082 [FIN, ACK] Seq=1 Ack=1 Win=68 Len=0

tshark man page:

-t a|ad|adoy|d|dd|e|r|u|ud|udoy

Set the format of the packet timestamp printed in summary lines. The format can be one of:

This is where the timestamp is set when writing -F k12text:

wiretap/k12text.l:

    ms = rec->ts.nsecs / 1000000;
    ns = (rec->ts.nsecs - (1000000*ms))/1000;

    tmp = gmtime(&rec->ts.secs);
    if (tmp == NULL)
        snprintf(p, 90, "+---------+---------------+----------+\r\nXX:XX:XX,");
    else
        strftime(p, 90, "+---------+---------------+----------+\r\n%H:%M:%S,", tmp);
    wl = strlen(p);
    p += wl;
    left -= wl;

    wl = snprintf(p, (gulong)left, "%.3d,%.3d   %s\r\n|0   |", ms, ns, str_enc);

~$ cat tmp.txt
+---------+---------------+----------+
02:47:09,488,229   ETHER
|0   |ec|f4|bb|4a|4e|de|f0|9f|c2|df|16|1f|08|00|45|00|00|28|ad|4a|40|00|3c|06|44|da|68|12|5b|69|c0|a8|c8|87|01|bb|46|a2|02|c6|0f|66|bc|e2|7e|d5|50|11|00|44|cc|a2|00|00|00|00|25|c4|b8|3b|
edit flag offensive delete link more

Comments

any option to get the time in epoch time?

BMWE gravatar imageBMWE ( 2023-06-08 09:29:04 +0000 )edit

Would require a custom build that modifies wiretap/k12text.l. Or post-process the output file with a script to translate time format.

Chuckc gravatar imageChuckc ( 2023-06-08 09:32:43 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

2 followers

Stats

Asked: 2023-06-08 08:41:02 +0000

Seen: 596 times

Last updated: Jun 08 '23