The same questions in tshark
tshark reads a file you already have and prints fields or a statistic. -r is the mode this lesson uses.
A file in, text out
tshark is Wireshark’s command-line reader. For this curriculum every command starts with -r and a pcapng you already saved in the lab. -n keeps name resolution off. -Y takes a display filter, the same language as the box in the graphical window. -T fields -e field prints columns you choose. -E header=y -E separator=, makes a sheet you can open later. The sample below is DNS answers to the lab client, because the response code lives on the answer, not on the question.
The filter language does not change because you are in a terminal. If the field is red in Wireshark, it is a bad -Y here too. Test the filter on a small file first. A quote that the shell eats will look like a broken filter. Keep the filter inside quotes so && stays part of the filter.
tshark -n -r lab.pcapng -Y "dns.flags.response == 1 && ip.dst == 10.8.0.40" -T fields -e frame.time_relative -e ip.src -e dns.qry.name -e dns.flags.rcode -E header=y -E separator=,
Tables you already know
-q -z conv,tcp prints TCP conversations. -q -z endpoints,ip prints addresses. -q -z io,phs prints the protocol hierarchy. -q -z expert prints the expert notes. -q -z follow,tcp,ascii,7 prints TCP stream 7 as text. These read the file. They are the same tables as the menus, which is the point: a note can include the command that rebuilds the table.
A display filter can be part of the statistic. io,stat takes an interval and a filter so the column matches the I/O graph you would have drawn. Write the command above the paste. Future you should not have to reverse-engineer a column of numbers.
Worked case: server names from the morning file
You need every Client Hello from 10.8.0.40 in the morning file, with the time, the destination, and the server name. The graphical filter is tls.handshake.type == 1 && ip.src == 10.8.0.40. The tshark line prints frame.time_epoch, ip.dst, and tls.handshake.extensions_server_name. You redirect the text to a file in the case folder. The pcapng stays where it was.
One row is empty in the server-name column. You go back to that frame in Wireshark and find an encrypted client hello extension. The blank cell is a real observation, not a broken -e flag. The command did what the details tree does, in bulk.
tshark -n -r lab.pcapng -Y "tls.handshake.type == 1 && ip.src == 10.8.0.40" -T fields -e frame.time_epoch -e ip.dst -e tcp.dstport -e tls.handshake.extensions_server_name -E header=y -E separator=,
Read-only on purpose
This lesson does not start a capture. Recording an interface is a separate authorization from reading a file the lab already produced. If a command you found online begins with an interface flag, it is not the command for this page.
The CSV can still contain a server name, a query name, or, if you printed the wrong field, a cookie. Treat the text extract as a copy of the evidence. Store it with the pcapng.
Diagram
From a display filter you already trust to a table you can file
- Filter
Prove the display filter in Wireshark on a small slice of the file.
- Fields
Print only the fields the note needs, with -n and -r.
tshark -n -r lab.pcapng -Y "tls.handshake.type == 1" -T fields -e ip.dst -e tls.handshake.extensions_server_name
- Statistic
Use -z when the question is a conversation table, a hierarchy, or one stream.
- File
Save the text next to the pcapng. Quote the command above it.
Check yourself
1. Which invocation matches this lesson’s rule for reading a lab file?
2. You want the query names from 10.8.0.40 as text. Which piece selects the column?
3. How do you print TCP stream 7 as text from a saved file?