The displayed values are HTTP request mode and HTTP status code. Http, tree: Calculate HTTP packet distribution. The displayed values are HTTP status code and HTTP request method. Z: various statistics options, specific reference documents, which will be described later, you can use the tshark -z help command to view all supported fields Q: output data only at the end of capture, useful for statistics commands Tshark -n -q -z http, stat, -z http, tree E: When the -T field is specified, set which fields are output Header = y means the header is to be printed
E: When the -T field is specified, set the output options. can be found in the filtering expression of wireshark, which will be described in detail later R: read the local file, you can capture the packet and save it for analysis Tshark -r test.cap -R ‘(mand_id = 0x80000004) and (mand_status = 0x0)’ -e ssage_id -e frame.time -T fields -E header = y> test.txt Example of exporting the header and value of the smpp protocol Tshark -s 512 -i eth0 -n -f ‘tcp dst port 3306’ -R ‘mysql.query’ -T fields -e mysql.query Print the current mysql query statement in real time I: output to the command line interface
T, -e: refers to printing these two fields F: only capture protocol is tcp, destination port is 80 N: Disable network object name resolution Tshark -s 512 -i eth0 -n -f 'tcp dst port 80' -R 'http.host and ' -T fields -e http.host -e -l | tr- d '\ t' Print http protocol stream related information I will summarize the results from the relevant examples, options, and some instances of the operation.Ģ, first of all, let's look at some examples on the Internet, I have organized these examples, and give a description. This time will be used to the Tshark command-line tool, you can use the command to extract the data you want, you can redirect to the file, you can also combine the upper language such as Java, to invoke the command line, to achieve the processing of data! The purpose of this blog is to facilitate access, the use of Wireshark can analyze the packet, you can edit the filter expression to achieve the analysis of the data, but my need is, how to export the data part, because the subsequent work is mainly for a packet of the database part, Parsing is primarily done on locally stored. Wireshark command line tools TSHARK1, purpose
0 kommentar(er)
