tshark conversation output lopsided
I am entering: tshark -r file.pcap -q -z conv,udp. Regardless of how long I let the file run, as an example...if bytes sent are 100, the response bytes are 0; if the bytes sent are 0, the response bytes are 100. Completely counter-intuitive to what the command is supposed to do. I could understand if the response is 0 when 100 bytes are sent - perhaps because the destination port is closed, or for any other reason - but when the response bytes are 100 without any bytes having been sent, then I'm lost. Can someone please test the command and let me know what you get.
Again, works for me. What kind of traffic are you capturing, i.e. what is running on top of UDP?
Thank you Grahamb. I am just reading(-r) an old capture file. The info that I need is bytes sent vs bytes returned in conv,udp. I entered: tshark -r file.pcap -q -z conv,udp. But, as I mentioned, I get either bytes sent, or bytes returned; not bytes sent and bytes returned. How did you enter the command to have it work?
@grahamb With tshark 2.6.7 I get different results for different protocols. RTP seems to be split:
While DNS and NTP seem to be fine:
(more)So the RTP "conversations" seem to be unidirectional. Odd. I don't have any voip like stuff to look at to comment any further.
I see that it works for you. I'm using tshark version 3.0.0 so the output displays a bit different. Here are a couple of lines which tell my story:
tcp produces the same result / issue.
seems this medium is not set up to accept what I tried to type. I typed two lines which show the "lopsidedness" with 0 bytes in one direction and vise versa, as I mentioned earlier.
@rvelez3 Use the "code" button in the editor to apply a fixed format to output text. Even then it tends to wrap, so some careful editing to remove spaces helps.
I'll have to ask again, what protocols are running atop tcp? Can you share a capture file?
As you asked elsewhere, instead of on this question, here is some output using tshark 3.1.0, i.e. current head of master:
(more)Hi. Are you able to run the conv,udp command in version 3.0.0 of tshark. This would help me determine what is wrong with the way I'm approaching this. Also, perhaps you can tell me how to run version 3.1.0 as you did yesterday; I'm guessing I would have to tell the command line interface to run 3.1.0?? Thank you for assistance with this.
I use 3.1.0 because I'm developing on the trunk, not because there's anything wrong with 3.0.0. You can try the automated builds from [here] (https://www.wireshark.org/download/au...).
You can install multiple versions of Wireshark, you need to use a different install directory for each version. To run any version on the command line simply prefix the command, e.g. tshark with the path to it, e.g.
"C:\Program Files\Wireshark-3.1.0\tshark.exe".Hi Grahamb. Hope you have time for a question. Regarding the file I was reading...the basis of my questions...I think the reason there were no return bytes is because I was reading an old pre-captured darknet file, and as you probably know "nothing comes out of the darknet", hence no return bytes. Does this make sense to you. My question is: there is a tshark command which routes a file to Excel. Is there a way to geo position an IP address directly from Excel ?
It's entirely possible to only capture data in one direction for many reasons. The
-z,convreport can only report on what it finds in the capture file.You should create a new question for your Excel query, similarly for your GEOIP question Have you searched for previous questions on these subjects?
Will search. Thank you for your support !!!