Actually, am caught up in a flux and was looking for some help.
I have a 1 GB file with data from multiple IP's. I use ngrp to find a particular keyword in the file and then find the source IP and destination IP of that packet where the keyword was present. I then used tshark and the found IP's to create another PCAP from the large PCAP of packets of only the communication between those two IP's. However, when I run my Python script to decode the created PCAP file, it does not give any results. While the same script on the original PCAP gives results. I have tried multiple options but nothing seems to give me the right results. Can you suggest a method to help me with this problem? Would be really grateful
asked 24 Mar '11, 07:28
I guess your filter is the problem:
If you do it like that you will probably get zero packets, resulting in an empty file (well, it'll have 24 bytes for pcap file headers, but not a single frame). The reason for it is in the way Wireshark prefers "and" and "or" statements when there are no brackets to prioritize - I'm not 100% sure but I think the way Wireshark parsed your statement is like this:
That way you ended up with the filter requesting both IP source and destination to be the same IP, which of course never matched. You need to either use packethunter's syntax for filtering, or put brackets around the "and" blocks like this:
Things for you to do:
P.S: next time just comment your question again to bring it back up to anyone's attention if you're wondering why there is no further answer. Trying to email me for private help isn't the exact idea of this Q&A forum - others might be interested in the answers, too ;-)
answered 27 Mar '11, 03:43
Actually I used a little different version of this. I user "ip.src == 220.127.116.11 and ip.dest == 18.104.22.168" or "ip.src == 22.214.171.124" and "ip.dest == 126.96.36.199"
This way I was trying to capture the entire communication between only two IP's from a host of IP's. Yet, the formed PCAP has some segmentation fault or tcp pur of sequence or malformed packet error. As a result I cant decode it.
answered 24 Mar '11, 23:45