malocho's profile - activity

I couldn't find a way to extract all raw packets from a PCAP file.

there is something like:

tshark -r file.pcap -T fields -e frame.number -e data

however, it doesn't return the entire packet.

it should be something like:

tshark -T jsonraw -j "http tcp ip" -x -r file.pcap

however with only frame.raw output for each packet.

My desired out is (frame number and any format of the entire packets):

1 00a0c58fe3c7000c761c1b97080045000028939e40004006f9adc0a80121ccb21f08db2d023467a50f421c83f58350100993926d0000
2 08db2d023468fe3c7000c761c1b97080045000028939e40004006f9adc0a80121ccb21f08db2d023467a50f421c83f58350100993926d0000
....

installed a new version! it finally works... so long discussed without checking the version :) I thank you a lot and al

I believe that it works on your machine... however on the packet (saved in a .pcap) in my scenario it doesn't return the

@Chuckc I don't know why but in my case it doesn't behave in this way... I only get the eth frame when I use --disable-p

I need the entire packet, your command returns only the part with ethernet frame, the remaining part is missing. I tri

I only use tshark, it it possible to do it only with tshark?

I need only the tshark program, I mean you speak about wireshark.

I tried this one: tshark -r UseCase2.pcap -T fields -e frame.number -e eth.addr -e eth.type -e data -Y frame.number==1 |

@johnthacker sorry for such a silly question... do you speak about the wireshark repo? or where is the repo of tshark?

tshark: Configuration Profile "NO_PROTOCOLS" does not exist

thank you! I will take a look

@johnthacker, of course, it would work with the produced JSON and preprocessing afterward, however, one of the significa

how to get entire raw packets by using the tshark? I couldn't find a way to extract all raw packets from a PCAP file.

how to get entire raw packets by using the tshark? I couldn't find a way to extract all raw packets from a PCAP file.

how did you construct -o filter? Your version only returns the frame number when I try it

-o <preference>:<value> Set a preference value, overriding the default value and any value read from a pref

I don't see a significant difference to my second provided example: tshark -T jsonraw -j "http tcp ip" -x -r file.pcap.

how to get entire raw packets by using the tshark? I couldn't find a way to extract all raw packets from a PCAP file.

how to get entire raw packets by using the tshark? I couldn't find a way to extract all raw packets from a PCAP file.