Zahra's profile - activity

Hi,

I want to make decision on packet based on their transport layer protocol (Whether it is TCP or UDP). Now I do it by checking whether the tcp.srcport is set or not. How can I change the protocols layer shown in _ws.col.Protocol to transport layer instead of application layer in the output of the following command?

tshark -r  capture.pcap  -T fields -E separator=, -e frame.number -e frame.time_epoch -e ip.src -e ip.dst -e frame.len -e _ws.col.Protocol -E header=y -E quote=d -E occurrence=f > capture.csv

According to tshark manpage, It seems that -j or -J option do something similar to what I needed, but I couldn't find such example.

Thanks, ip.proto works in my case.

How to specify that tshark shows packets' protocol at transport layer not application layer? Hi, I want to make decisio

Thanks for the tip.

Thanks for your support , I have asked my question at stackoverflow

I have updated my question with the code I have written, can you help me with that?

I have updates my question with the code I have written, code you help me with that?

How to convert TcpDump output to Pcap Previously, I have converted some TcpDump output as text to Pcap file with your he

Thanks, I'll come back to you when I have written the script.

Unfortunately, I found out about the problem with captured file, when it was too late. Now, I want to generate a pcap fi

@Spooky They are some traffic captured in past, and I wana to have some pcap for them.

How to convert TcpDump output to Pcap Previously, I have converted some TcpDump output as text to Pcap file with your he

@Uli. Yes TCP, SSL, and SSLv2, SSLv3. Also, it marks the packet as TCP when tcp.len>0 and is TCP segment of reassembl

Yes TCP, SSL, and SSLv2, SSLv3. Also, it marks the packet as TCP when tcp.len>0 and is TCP segment of reassembled PDU

Is it possible that wireshark doesn't recognize protocol? I have some encrypted traffic but, for the same source and des

How can I filter out the protocol, sequence number, and ack using tshark? I could filter out other options as follow:

tshark -r traffic.pcap -T fields -E separator=, -e frame.number -e frame.time_epoch -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport  -e frame.len -e tcp.flags  -e _ws.col.Info -E header=y -E quote=d -E occurrence=f

filtering out protocol, sequence number, and ack using tshark How can I filter out the protocol, sequence number, and a

could you help me with it? how should I check them myself?

The captured traffic isn't in the readable format of the Wireshark. I have just the header of the captured traffic as th

How to filter out TCP retransmissions I have the tcp and ip header of some captured traffic as follow: 1510103571.96303