how to use tshark to divide a packet into several records?
I have encountered a problem where I used tshark to extract a packet like that:
Internet Protocol Version 4, Src: 192.168.0.33, Dst: 192.168.0.15
Transmission Control Protocol, Src Port: 179, Dst Port: 2124, Seq: 49, Ack: 265
Border Gateway Protocol - UPDATE Message
...
Path attributes
...
Path Attribute - AS_PATH: 1 2
...
Border Gateway Protocol - UPDATE Message
...
Path attributes
...
Path Attribute - AS_PATH: 1 3
...
Border Gateway Protocol - UPDATE Message
...
Path attributes
...
Path Attribute = AS_PATH: 2 4
...
when I use a command like tshark -r a.cap -e bgp.update.path_attribute.as_path_segment.as4 ..., I get a result like "1 2 1 3 2 4", which is not what I want. I am confused how to use tshark so that I can get results like "1 2","1 3","2 4" as three records?
I assume you use -T as well? Have you looked into -E, the field print options?
Thanks a lot for your reply. I use parameter -T and don't use parameter "-E", but according to the user guide by default it will use "-E aggregator=,", which means that it results in the output like "1,2,1,3,2,4". In this case, I can't distinguish which items belongs to the same message. It may be divided into three parts like "1,2","1","3,2,4", or others. Therefore I think this parameter can't help me solve my problem. Looking forward to your reply again.
Have you tried working with -E quote=... as well? Otherwise I would have to look into how the output of values you referenced are being produced (if I can find a BGP capture like this) and see what the code is.
The parameter "-E quote" is used to defined the character used to surround fields, which means that when you use command like "-E quote=s" you will get a result like:
'time' '1' '1,2' ...
It doesn't work inside fields, so I don't think it can solve my problem. I try to upload a sample but unfortunately I don't have enough points to do that. Here is another sample called BGP_AS_set.cap. After you download it, you can try using tshark to extract the AS_PATH and see if you can get the right result that "30" belongs to the AS_SEQUENCE and "{10,20}" belongs to the AS_SET. Please show me your command if you make it success.
Here is my simplified code (some -e fields are ignored):
tshark -r a.cap -Y "bgp.type==2" -T fields -E quote=d-e ip.src -e ip.dst -e ...(more)