follow stream with more information in tshark

Question

Hi I want to save 2000 streams in separate txt files but for my work I need each of ascii files involes full information about all packets that made the stream like follow tcp in wireshark!

I ran this script:

  for stream in $(tshark -nlr $file -Y tcp.flags.syn==1 -T fields -e tcp.stream | sort -n | uniq | sed 's/\r//')
    do
        echo "Processing stream $stream"
        tshark -nlr $file -qz "follow,tcp,ascii,$stream" > stream-$stream.log
    done

but this script give me just a little information like that:

 Follow: tcp,ascii
    Filter: tcp.stream eq 962
    Node 0: 245.234.7.168:51099
    Node 1: 40.170.249.141:80

I want to save all of information about all packets in the stream in one file. tnx

Answer 1

What makes you think there is more information available for that stream, 962 in this case? What more does Wireshark show if you filter using tcp.stream eq 962 then "Follow TCP Stream"? More than likely, there's no data being transferred for that particular stream and so there's nothing more to show/save.

Answer 2

I'm not sure, but I believe you want to write single TCP conversations/streams into separate files, possibly in pcap format.

Well, there are several ways to do that.

Please see the answers for the following questions and the tools mentioned there.

http://ask.wireshark.org/questions/16690/split-pcap-file-into-smaller-pcap-file-according-to-tcp-flow
http://ask.wireshark.org/questions/4677/easy-way-to-save-tcp-streams
http://ask.wireshark.org/questions/19995/automated-tcp-reassembler