Tshark -i wlan0 -f 'src port 53' -n -T fields -e -e 68 đ71.64.144.142ħ4 đ71.67.215.200Īdd time and source / destination IP addresses -e frame.time -e ip.src -e ip.dst to your output. Here is an example that extracts both the DNS query and the response address. tshark -r example.pcap -Y http.request -T fields -e http.host -e ip.dst -e _uri DNS Analysis with Tshark As you can see, by combing different filters and output fields, we can create very complex data extraction commands for tshark that can be used to find interesting things within a capture. Other fields we could include in the output are -e ip.dst and -e. We could perform a similar analysis with the request URL in place of the user agent -e _uri.

Using additional HTTP filters in Analysis This can be used to detect malware, old browsers on your network and scripts. Using this, we can quickly parse a pcap, even if it is very large and get a summary of all the user agents seen. tshark -r example.pcap -Y http.request -T fields -e http.host -e er_agent | sort | uniq -c | sort -n Note in this example, combining with standard shell commands allows us to sort and count the occurrences of the er_agent. Using the previous command to extract er_agent, this time extracting from a pcap rather than off the live interface. Parse User Agents and Frequency with Standard Shell Commands We could also use the parameter -E seperator=, to change the delimiter to a comma. The default separator for the fields in the output above is TAB. Tshark -i wlan0 -Y http.request -T fields -e http.host -e er_agent Mozilla/5.0 (X11 Ubuntu Linux x86_64 rv:36.0) Gecko/20100101 Firefox/36.0 Using the -T we specify we want to extract fields, and with the -e options we identify which fields we want to extract. In the following example, we extract data from any HTTP requests that are seen. Capture Packets with Tshark tshark -i wlan0 -w capture-output.pcap Read a Pcap with Tshark tshark -r capture-output.pcap HTTP Analysis with Tshark

As you can see, the syntax for capturing and reading a pcap is very similar to tcpdump. Use these as the basis for starting to build your extraction commands.

Linux wireshark command line commands