Ask Your Question
0

dumpcap using frame contains and write to file

asked 2018-10-23 09:43:13 +0000

anonymous user

Anonymous

i want to filter out specific tcp packets that contain a specific string in the frame data (data.data)

As you may know, you can't write to file and use a display filter at the same time, and i wonder if there's a workaround for this?

dumpcap -i 1 -f "tcp port 8800" -Y "frame contains FILE"  -w "data.txt"

this is what i want. but it gives me error message that i described above.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-10-24 00:24:27 +0000

Guy Harris gravatar image

Presumably by "dumpcap" you mean "tshark"; if you try running dumpcap with that command, it will tell you that dumpcap doesn't support the -Y flag (which it doesn't - and which it won't, as that would require that it include the Wireshark dissection library and, because dumpcap may have to run with elevated privileges, including dissection in it would mean that a lot of code would run with elevated privileges, which isn't safe).

Note also that if you are using tshark, "data.txt" won't be a text file, it'll be a pcap or pcapng file; if you want the dissection output from tshark to go to a file, you redirect the standard output to a file.

And, in fact,

tshark -i 1 -f "tcp port 8800" -Y "frame contains FILE" >data.txt

will work.

If you do want the raw packet data in a pcap or pcapng file, and want to use a read filter, you can't do that; you'd have to write unfiltered raw data, and then run tshark again to do the filtering.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-10-23 09:43:13 +0000

Seen: 592 times

Last updated: Oct 24 '18