Exclude streams having retransmissions
I have a lot of streams in my pcap. I am finding a way to exclude the stream where I find a restransmission flag set.
I have tried this below command to find clean streams.
$ tshark -r trace.pcap -Y "not tcp.analysis.retransmission" -T fields -e tcp.stream > streams.out
But when I use the about "streams.out" file to create a filter of clean OR'ed streams using below shell command:
$ cat /tmp/x | sort -un | sed ':a;N;$!ba;s/\n/ or tcp.stream==/g'
and using it directly in the filter give me error:
$ tshark -r trace.pcap -Y "`cat /tmp/x | sort -un | sed ':a;N;$!ba;s/\n/ or tcp.stream==/g'`"
tshark: argument list too long.
Thats because I have a huge number of streams in my pcap. Is there a direct way to exclude the streams from the pcap.
-Y "not tcp.analysis.flags"Doesn't this match the
SYNpacket of every stream?Would it better to get a list of all the streams that include a
tcp.analysis.flagspacket then delete those from a list of all streams?Are you open to doing it with a lua script?
using tshark with huge display filters
My list of streams that not include the filter is also a very big list.
"argument list too long." is coming from the operating system.
You could break the list into smaller pieces, make multiple output files them merge them with mergecap.
If the argument is only slightly too long, note that you can make a much shorter filter with
tcp.stream in {X,...,Y}