Extracting PCAP using Tshark

Question

I'm trying to extract PCAP using Tshark tool. Is there any way to get the file information like source and destination IP, source and destination port and timestamp of each file extracted from the Tshark? For example. I'm extracting file sample.pcap with command for http :

tshark -q -r sample.pcap --export-objects 'http,tshark_extract_directory'

Following files are generated,

%2f
gSEUozajoHorzUcfwjgep5-0HOV5tn4pzQS8exfGPXFOBGBQWrEcD1wKpJQk2T59 3h251q2c35
qxrWmriaPVb2cBLwxw1uR_EEnOuZR9mgVr3ReB3-1yiVm9H15-VbU3vylDw4RGW3 d2a42e1f7d9a1021bd7d93af414c95c4(1).php%3fq=70a9b40eb73da11445c3a3609c8241d9' RSBbr6XDxZwv-i2lhZFras66SJRIL5vez28iuddGQjo94jue4fGqpAN9QPAW_yPY d2a42e1f7d9a1021bd7d93af414c95c4.php%3fq=70a9b40eb73da11445c3a3609c8241d9' xEztiZ7NM12Vj9c2RTB_MT0UEYH_re0UqLWZq_vBhBZGq0KGVP1BTVXxVeSy3Veo d6bc1dc7da4ed54a62b93b5d0f1cc40c.swf

Extracted files seems to have no proper naming and even if I look inside the files, I can hardly find the information I needed. Is it possible to get the source and destination ip or port for eg '3h251q2c35' file? If possible how?

Patz Patz · Accepted Answer · 2019-08-13T20:27:13

You can use -T & -e option which can extract individual fields from the pcap file Example with -Tjson

tshark -r <pcap_file> -Y <filter> -Tjson -e ipv6.src -e ipv6.dst -e tcp.srcport -e tcp.dstport -e frame.time

You should get something like

[
  {
    "_index": "packets-2019-08-12",
    "_type": "pcap_file",
    "_score": null,
    "_source": {
      "layers": {
        "ipv6.src": [
          "xxxxxx"
        ],
        "ipv6.dst": [
          "xxxxxx"
        ],
        "tcp.srcport": [
          "1"
        ],
        "tcp.dstport": [
          "2"
        ],
        "frame.time": [
          "<time>"
        ]
      }
    }
  }
]

Hope that helps!

Extracting PCAP using Tshark

1 Answers