++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++ [[AppTools]] [appendix] == Related command line tools [[AppToolsIntroduction]] === Introduction Along with the main application, Wireshark comes with an array of command line tools which can be helpful for specialized tasks. These tools will be described in this chapter. You can find more information about each command in the link:{wireshark-man-page-url}[Manual Pages]. [[AppToolstshark]] === __tshark__: Terminal-based Wireshark TShark is a terminal oriented version of Wireshark designed for capturing and displaying packets when an interactive user interface isn't necessary or available. It supports the same options as `wireshark`. For more information on `tshark` see the manual pages (`man tshark`). [[AppToolstsharkEx]] .Help information available from `tshark` ---- TShark (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master) Dump and analyze network traffic. See https://www.wireshark.org for more information. Usage: tshark [options] ... Capture interface: -i name or idx of interface (def: first non-loopback) -f packet filter in libpcap filter syntax -s packet snapshot length (def: 262144) -p don't capture in promiscuous mode -I capture in monitor mode, if available -B size of kernel buffer (def: 2MB) -y link layer type (def: first appropriate) -D print list of interfaces and exit -L print list of link-layer types of iface and exit Capture stop conditions: -c stop after n packets (def: infinite) -a ... duration:NUM - stop after NUM seconds filesize:NUM - stop this file after NUM KB files:NUM - stop after NUM files Capture output: -b ... duration:NUM - switch to next file after NUM secs filesize:NUM - switch to next file after NUM KB files:NUM - ringbuffer: replace after NUM files RPCAP options: -A : use RPCAP password authentication Input file: -r set the filename to read from (- to read from stdin) Processing: -2 perform a two-pass analysis -R packet Read filter in Wireshark display filter syntax -Y packet displaY filter in Wireshark display filter syntax -n disable all name resolutions (def: all enabled) -N enable specific name resolution(s): "mnNtCd" -d ==, ... "Decode As", see the man page for details Example: tcp.port==8888,http -H read a list of entries from a hosts file, which will then be written to a capture file. (Implies -W n) --disable-protocol disable dissection of proto_name --enable-heuristic enable dissection of heuristic protocol --disable-heuristic disable dissection of heuristic protocol Output: -w write packets to a pcap-format file named "outfile" (or to the standard output for "-") -C start with specified configuration profile -F set the output file type, default is pcapng an empty "-F" option will list the file types -V add output of packet tree (Packet Details) -O Only show packet details of these protocols, comma separated -P print packet summary even when writing to a file -S the line separator to print between packets -x add output of hex and ASCII dump (Packet Bytes) -T pdml|ps|psml|text|fields format of text output (def: text) -e field to print if -Tfields selected (e.g. tcp.port, _ws.col.Info) this option can be repeated to print multiple fields -E= set options for output when -Tfields selected: header=y|n switch headers on and off separator=/t|/s| select tab, space, printable character as separator occurrence=f|l|a print first, last or all occurrences of each field aggregator=,|/s| select comma, space, printable character as aggregator quote=d|s|n select double, single, no quotes for values -t a|ad|d|dd|e|r|u|ud output format of time stamps (def: r: rel. to first) -u s|hms output format of seconds (def: s: seconds) -l flush standard output after each packet -q be more quiet on stdout (e.g. when using statistics) -Q only log true errors to stderr (quieter than -q) -g enable group read access on the output file(s) -W n Save extra information in the file, if supported. n = write network address resolution information -X : eXtension options, see the man page for details -z various statistics, see the man page for details --capture-comment add a capture comment to the newly created output file (only for pcapng) Miscellaneous: -h display this help and exit -v display version info and exit -o : ... override preference setting -K keytab file to use for kerberos decryption -G [report] dump one of several available reports and exit default report="fields" use "-G ?" for more help WARNING: dumpcap will enable kernel BPF JIT compiler if available. You might want to reset it By doing "echo 0 > /proc/sys/net/core/bpf_jit_enable" ---- [[AppToolstcpdump]] === __tcpdump__: Capturing with `tcpdump` for viewing with Wireshark It's often more useful to capture packets using `tcpdump` rather than `wireshark`. For example, you might want to do a remote capture and either don't have GUI access or don't have Wireshark installed on the remote machine. Older versions of `tcpdump` truncate packets to 68 or 96 bytes. If this is the case, use `-s` to capture full-sized packets: ---- $ tcpdump -i -s 65535 -w ---- You will have to specify the correct _interface_ and the name of a _file_ to save into. In addition, you will have to terminate the capture with ^C when you believe you have captured enough packets. +tcpdump+ is not part of the Wireshark distribution. You can get it from {tcpdump-main-url} or as a standard package in most Linux distributions. [[AppToolsdumpcap]] === __dumpcap__: Capturing with `dumpcap` for viewing with Wireshark Dumpcap is a network traffic dump tool. It captures packet data from a live network and writes the packets to a file. Dumpcap's native capture file format is pcapng, which is also the format used by Wireshark. Without any options set it will use the pcap library to capture traffic from the first available network interface and write the received raw packet data, along with the packets' time stamps into a pcapng file. The capture filter syntax follows the rules of the pcap library. [[AppToolsdumpcapEx]] .Help information available from dumpcap ---- Dumpcap (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master) Capture network packets and dump them into a pcapng or pcap file. See https://www.wireshark.org for more information. Usage: dumpcap [options] ... Capture interface: -i name or idx of interface (def: first non-loopback), or for remote capturing, use one of these formats: rpcap:/// TCP@: -f packet filter in libpcap filter syntax -s packet snapshot length (def: 262144) -p don't capture in promiscuous mode -I capture in monitor mode, if available -B size of kernel buffer in MiB (def: 2MiB) -y link layer type (def: first appropriate) -D print list of interfaces and exit -L print list of link-layer types of iface and exit -d print generated BPF code for capture filter -k set channel on wifi interface ,[] -S print statistics for each interface once per second -M for -D, -L, and -S, produce machine-readable output RPCAP options: -r don't ignore own RPCAP traffic in capture -u use UDP for RPCAP data transfer -A : use RPCAP password authentication -m use packet sampling count:NUM - capture one packet of every NUM timer:NUM - capture no more than 1 packet in NUM ms Stop conditions: -c stop after n packets (def: infinite) -a ... duration:NUM - stop after NUM seconds filesize:NUM - stop this file after NUM KB files:NUM - stop after NUM files Output (files): -w name of file to save (def: tempfile) -g enable group read access on the output file(s) -b ... duration:NUM - switch to next file after NUM secs filesize:NUM - switch to next file after NUM KB files:NUM - ringbuffer: replace after NUM files -n use pcapng format instead of pcap (default) -P use libpcap format instead of pcapng --capture-comment add a capture comment to the output file (only for pcapng) Miscellaneous: -N maximum number of packets buffered within dumpcap -C maximum number of bytes used for buffering packets within dumpcap -t use a separate thread per interface -q don't report packet capture counts -v print version information and exit -h display this help and exit WARNING: dumpcap will enable kernel BPF JIT compiler if available. You might want to reset it By doing "echo 0 > /proc/sys/net/core/bpf_jit_enable" Example: dumpcap -i eth0 -a duration:60 -w output.pcapng "Capture packets from interface eth0 until 60s passed into output.pcapng" Use Ctrl-C to stop capturing at any time. ---- [[AppToolscapinfos]] === __capinfos__: Print information about capture files +capinfos+ can print information about binary capture files. [[AppToolscapinfosEx]] .Help information available from capinfos ---- Capinfos (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master) Print various information (infos) about capture files. See https://www.wireshark.org for more information. Usage: capinfos [options] ... General infos: -t display the capture file type -E display the capture file encapsulation -I display the capture file interface information -F display additional capture file information -H display the SHA1, RMD160, and MD5 hashes of the file -k display the capture comment Size infos: -c display the number of packets -s display the size of the file (in bytes) -d display the total length of all packets (in bytes) -l display the packet size limit (snapshot length) Time infos: -u display the capture duration (in seconds) -a display the capture start time -e display the capture end time -o display the capture file chronological status (True/False) -S display start and end times as seconds Statistic infos: -y display average data rate (in bytes/sec) -i display average data rate (in bits/sec) -z display average packet size (in bytes) -x display average packet rate (in packets/sec) Output format: -L generate long report (default) -T generate table report -M display machine-readable values in long reports Table report options: -R generate header record (default) -r do not generate header record -B separate infos with TAB character (default) -m separate infos with comma (,) character -b separate infos with SPACE character -N do not quote infos (default) -q quote infos with single quotes (') -Q quote infos with double quotes (") Miscellaneous: -h display this help and exit -C cancel processing if file open fails (default is to continue) -A generate all infos (default) Options are processed from left to right order with later options superceding or adding to earlier options. If no options are given the default is to display all infos in long report output format. ---- [[AppToolsrawshark]] === __rawshark__: Dump and analyze network traffic. Rawshark reads a stream of packets from a file or pipe, and prints a line describing its output, followed by a set of matching fields for each packet on stdout. [[AppToolsrawsharkEx]] .Help information available from rawshark ---- Rawshark (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master) Dump and analyze network traffic. See https://www.wireshark.org for more information. Usage: rawshark [options] ... Input file: -r set the pipe or file name to read from Processing: -d | packet encapsulation or protocol -F field to display -n disable all name resolution (def: all enabled) -N enable specific name resolution(s): "mnNtCd" -p use the system's packet header format (which may have 64-bit timestamps) -R packet filter in Wireshark display filter syntax -s skip PCAP header on input Output: -l flush output after each packet -S format string for fields (%D - name, %S - stringval, %N numval) -t ad|a|r|d|dd|e output format of time stamps (def: r: rel. to first) Miscellaneous: -h display this help and exit -o : ... override preference setting -v display version info and exit ---- [[AppToolseditcap]] === __editcap__: Edit capture files +editcap+ is a general-purpose utility for modifying capture files. Its main function is to remove packets from capture files, but it can also be used to convert capture files from one format to another, as well as to print information about capture files. [[AppToolseditcapEx]] .Help information available from editcap ---- Editcap (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master) Edit and/or translate the format of capture files. See https://www.wireshark.org for more information. Usage: editcap [options] ... [ [-] ... ] and must both be present. A single packet or a range of packets can be selected. Packet selection: -r keep the selected packets; default is to delete them. -A only output packets whose timestamp is after (or equal to) the given time (format as YYYY-MM-DD hh:mm:ss). -B only output packets whose timestamp is before the given time (format as YYYY-MM-DD hh:mm:ss). Duplicate packet removal: -d remove packet if duplicate (window == 5). -D remove packet if duplicate; configurable Valid values are 0 to 1000000. NOTE: A of 0 with -v (verbose option) is useful to print MD5 hashes. -w remove packet if duplicate packet is found EQUAL TO OR LESS THAN prior to current packet. A is specified in relative seconds (e.g. 0.000001). -a : Add or replace comment for given frame number -I ignore the specified bytes at the beginning of the frame during MD5 hash calculation Useful to remove duplicated packets taken on several routers(differents mac addresses for example) e.g. -I 26 in case of Ether/IP/ will ignore ether(14) and IP header(20 - 4(src ip) - 4(dst ip)). NOTE: The use of the 'Duplicate packet removal' options with other editcap options except -v may not always work as expected. Specifically the -r, -t or -S options will very likely NOT have the desired effect if combined with the -d, -D or -w. Packet manipulation: -s truncate each packet to max. bytes of data. -C [offset:] chop each packet by bytes. Positive values chop at the packet beginning, negative values at the packet end. If an optional offset precedes the length, then the bytes chopped will be offset from that value. Positive offsets are from the packet beginning, negative offsets are from the packet end. You can use this option more than once, allowing up to 2 chopping regions within a packet provided that at least 1 choplen is positive and at least 1 is negative. -L adjust the frame (i.e. reported) length when chopping and/or snapping -t