leonardus's profile - activity

Filter based on paths I'm on CentOS. I'm analyzing some SMB traffic. I'd like to find TCP streams related to certain pa

I played with something similar. The thing with this is that there are inbound packets that have destination mac other t

Capture inbound packets only For example, with tcpdump, on some platforms something like tcpdump -i eth0 -Q in will capt

I want to extract some information from a pcap file that was generated without any filter.

But, all I need to extract that info is one frame.

What I'm currently doing is something like this:

good_frame=$(tshark -r file.pcap -Y 'filter expression'  -T fields -e frame.number | head -n1)
tshark -r file.pcap -Y 'frame.number=="$good_frame"' -T fields -e desired.field1 -e desired.field2

Is there a better way to do it?

I was thinking something like:

tshark -r file.pcap -Y 'filter expression' -c 1 -w - | tshark - -T fields -e desired.field1 -e desired.field2

Reading the documentation for -2 and -R, this makes a lot of sense. Thanks.

Correct. I'll filter for one protocol to find out whether that particular pcap file contains it. Then if it does, I get

Best way to get just one packet I want to extract some information from a pcap file that was generated without any filte