Ask Your Question
0

Tshark grep specific fields

asked 2024-11-20 05:37:09 +0000

LucasRey gravatar image

Hello community, I'm using tshark to decode on the fly the SMPP protocol, e.g.:

tshark -i any -V -Y smpp

This will show, in real time, every single SMPP packet, e.g.

Short Message Peer to Peer, Command: Submit_sm, Seq: 8475778, Len: 215
    Length: 215
    Operation: Submit_sm (0x00000004)
    Sequence #: 8475778
    Service type: (Default)
    Type of number (originator): Alphanumeric (0x05)
    Numbering plan indicator (originator): Unknown (0x00)
    Originator address: \123\110\123\123\123aaa\123
    Type of number (recipient): Unknown (0x00)
    Numbering plan indicator (recipient): ISDN (E163/E164) (0x01)
    Recipient address: 44123456789
    .... ..00 = Messaging mode: Default SMSC mode (0x00)
    ..00 00.. = Message type: Default message type (0x00)
    00.. .... = GSM features: No specific features selected (0x00)
    Protocol id.: 0x43

Is there a way to grep specific fields and output only these? I tried with:

tshark -i any -V -Y smpp | grep 'Operation|Type of number|Numbering plan indicator|Recipient address'

But it doesn't work. I tried also with:

tshark -i any -V -Y smpp -T fields -e 'smpp.dest_addr_ton' -e 'smpp.destination_addr'

But this will output only the value and I would like to output something like;

Type of number (recipient): Unknown (0x00)
Numbering plan indicator (recipient): ISDN (E163/E164) (0x01)
Recipient address: 44123456789

Could someone advice? Thank you, Lucas

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2024-11-20 05:43:29 +0000

LucasRey gravatar image

updated 2024-11-20 05:44:18 +0000

Oh damn! Someone, in other place, noticed me that I miss the -E in grep. This is working perfect:

tshark -i any -V -Y smpp | grep -E 'Operation|Type of number|Numbering plan indicator|Recipient address'

Sorry to waste forum space :)

edit flag offensive delete link more

Comments

If you only want to view fields from smpp in the packet details view, you can use -O smpp instead of -V. That would reduce the amount of text input to grep.

johnthacker gravatar imagejohnthacker ( 2024-11-20 13:06:14 +0000 )edit

Great, thank you for the tip!

LucasRey gravatar imageLucasRey ( 2024-11-20 14:28:46 +0000 )edit

@LucasRey: You might want to mark your own answer as the solution by pressing the grey checkmark on the left, so that other users know that your question was answered / solved.

Christian42 gravatar imageChristian42 ( 2024-11-26 12:15:04 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-11-20 05:37:09 +0000

Seen: 72 times

Last updated: Nov 20