Ask Your Question

tshark udp conversation command

asked 2019-04-07 17:54:51 +0000 gravatar image

updated 2019-04-07 18:31:48 +0000

grahamb gravatar image

I am running: tshark -r file.pcap -q -z conv,udp. However, I get repeated conversations between some ip address pairs(send/response), same port pair. Can someone test the udp command and tell me what you get. If you know of a better way please let me know.

edit retag flag offensive close merge delete


Works for me. You'll need to share a link to the capture that causes the issue for you. Upload the capture to a public file share, e.g. Google Drive, DropBox etc. and paste a link to the file in your question or as a comment.

grahamb gravatar imagegrahamb ( 2019-04-07 19:31:36 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-04-07 21:04:40 +0000 gravatar image

I realized that the ip addresses differ slightly; so they are not repeated.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-04-07 17:54:51 +0000

Seen: 402 times

Last updated: Apr 07 '19