Revision history [back]
filter for "data" to match packets
Dear all,
When I run tshark
on a particular trace file (file1.pcap) where let's say frame #1 is important to me and I want to search for the exact same frame inside another trace file (file2.pcap), here is what I try to do:
tshark -r file1.pcap -Y frame.number==1 -Tfields -e data
This gives me the payload of the frame without its headers as hex stream (same as if I right-click inside the hexpane).- For the other file where the exact same packet is also captured, I try to filter for that hex steam e.g. using
tshark -r file2.pcap -Y data=="<paste from step1>"
ortshark -r file2.pcap -Y data contains "<subset from that string>"
which both don't work.
However, if I use -Y "data contains 80:00:00"
where 80:00:00
is just a random example it works.
So my question is how to match the -Tfields -e data
output for "data" filtering without adding colons between every byte :)
filter for "data" to match packets
Dear all,
When I run tshark
on a particular trace file (file1.pcap) where let's say frame #1 is important to me and I want to search for the exact same frame inside another trace file (file2.pcap), here is what I try to do:
tshark -r file1.pcap -Y frame.number==1 -Tfields -e data
This gives me the payload of the frame without its headers as hex stream (same as if I right-click inside the hexpane).- For the other file where the exact same packet is also captured, I try to filter for that hex steam e.g. using
tshark -r file2.pcap -Y data=="<paste from step1>"
ortshark -r file2.pcap -Y data contains "<subset from that string>"
which both don't work.
However, if I use -Y "data contains 80:00:00"
where 80:00:00
is just a random example it works.
So my question is how to match the -Tfields -e data
output for "data" filtering without adding colons between every byte :)
filter for "data" to match packets
Dear all,
When when I run tshark on a particular trace file tshark
(file1.pcap) (file1.pcap) where let's say frame #1 is important to me and I want to search for the exact same frame inside another trace file (file2.pcap), (file2.pcap), here is what I try to do:
tshark -r file1.pcap -Y frame.number==1 -Tfields -edata Thisdata this gives me the payload of the frame without its headers as hex stream (same as if I right-click inside thehexpane).hexpane)- For the other file where the exact same packet is also captured, I try to filter for that hex steam e.g. using
tshark -r file2.pcap -Ydata=="<paste from step1>"data=="" ortshark -r file2.pcap -Y data contains"<subset from that string>"""
which both don't work.
However, if I use -Y "data contains 80:00:00" 80:00:00" where 80:00:00 is just a random example it works.80:00:00
So my question is how to match the -Tfields -e data data output for "data" "data" filtering without adding colons between every byte :)