I’m going to read in the value with the -c option which stands for count, so since I’m using ‘-c 1’ I’ll just get the first packet. To read in a file you would use ‘-r ’ or to sniff you’d use ‘-i ’ It’s core switches are very close to what you would use with tcpdump. Now that we got the lay of the land, seeing what our pcap is made up of, let’s get into what we came to do! Using tshark to parse some packets 🙂Įnter tshark! Tshark is the command line tool for Wireshark. Believe it or not we can also get some protocol statistics using tshark, getting the same info you would in Wireshark! $ tshark -qz io,phs -r ctf.pcapįtp.current-working-directory frames:71 bytes:6326įtup-frame frames:5 bytes:45402įtup-method frames:5 bytes:45402įmand-frame frames:5 bytes:45402įtp-data.current-working-directory frames:5 bytes:45402 We can glean how long the trace took place, how many packets we have, among other things.

SHA1: 9850abbf26d14f2636e1e65d6c64841047317f17Ĭapture oper-sys: 64-bit Windows 10 (2004), build 19041Ĭapture application: Mergecap (Wireshark) 3.4.0 (v3.4.0-0-g9733f173ea5e)Ĭapture comment: TraceWrangler v0.6.8 build 949 performed the following editing steps: - Replacing Linux Cooked header with Ethernet header If they were in Wireshark, most likely they’d venture into the Statistics tab and check out ‘Capture File Properties’ and ‘Protocol Hierarchy.’ Can we get this sort of information from the command line? You bet your bottom dollar we can! The first tool we can use is called capinfos: $ capinfos ctf.pcapįile timestamp precision: microseconds (6) The first thing people like to do when they encounter a new pcap is to get the lay of the land so to speak.

Tony E has a how-to on trace wrangler coming up on a network collective live-stream that can solve non-compatibility pcapng issues, and I digress. I mean, I originally tried to use tcpdump but since their file was saved as a pcapng it was not compatible without a little more work. You only love what you know right?! Well last week I embarked on a quest to find some flags on Cisco’s CTF 2021 using tshark. I wrote a quick intro to tcpdump some months ago as I was learning about the tool and I thought it was just the best.

Tshark filter