tshark过滤并保存包特定字段

1.过滤端口为5001的tcp包,将时间输出

tshark -r h1.pcap -Y "tcp.port==5001" -T fields -e frame.time

时间格式如

“Jan 1,2016 20:27:30.355595000 CST”

2.调整时间格式

tshark -r h1.pcap -Y "tcp.port==5001" -o column.format:"packet,%m,Time,%t,Info,%i"

%t输出格式为 10.710926

%Yt输出格式为 2016-01-01 20:27:30.355595

wireshark - How do I format tshark time to ISO format (yyyy-dd-mm)? - Stack Overflow

tshark\ -\ The\ Wireshark\ Network\ Analyzer\ 2.0.0

3.查看所有包数目

tshark -r test.cap | wc -l

c - Getting the number of packets in a pcap capture file? - Stack Overflow

4.输出特定字段

tshark -nr input.pcap -Y "display filter" -T fields -e frame.number -e tcp.seq -e tcp.options.timestamp.tsval

tshark -nr input.pcap -Y "display filter" -T fields -e frame.number -e tcp.seq -e tcp.options.timestamp.tsval

posted @ 2016-01-02 11:06  juejiang  阅读(6748)  评论(0编辑  收藏  举报