简介

命令行版本的 wireshark, 类似于 tcpdump.

TShark is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark’s native capture file format is pcapng format, which is also the format used by Wireshark and various other tools.

编译

参考 https://www.yuque.com/zzqcn/wireshark/pylrcy.

  1. $ makdir -p wireshark_build
  2. $ cd wirehark_build/
  3. $ cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_wireshark=off -DENABLE_LUA=on <wireshark>
  4. $ ninja

基本选项

pcap文件

抓包

过滤器

结果导出

统计

统计协议层

  1. $./tshark -z io,phs -r ~/pcap/http_gnu.pcap
  2. Protocol Hierarchy Statistics
  3. Filter: 
  5. eth                                      frames:49 bytes:35163
  6.   ip                                     frames:49 bytes:35163
  7.     tcp                                  frames:49 bytes:35163
  8.       http                               frames:10 bytes:6523
  9.         data-text-lines                  frames:2 bytes:2617
  10.           tcp.segments                   frames:1 bytes:1203
  11.         png                              frames:1 bytes:1174
  12.           tcp.segments                   frames:1 bytes:1174
  13.         image-jfif                       frames:1 bytes:267
  14.           tcp.segments                   frames:1 bytes:267

统计报文长度

  1. $./tshark -z plen,tree -r ~/pcap/http_gnu.pcap 
  2. Packet Lengths:
  3. Topic / Item       Count         Average       Min Val       Max Val       Rate (ms)     Percent       Burst Rate    Burst Start  
  4. ----------------------------------------------------------------------------------------------------------------------------------
  5. Packet Lengths     49            717.61        54            1448          0.0094        100%          0.1400        0.619        
  6.  0-19              0             -             -             -             0.0000        0.00%         -             -            
  7.  20-39             0             -             -             -             0.0000        0.00%         -             -            
  8.  40-79             20            56.40         54            66            0.0038        40.82%        0.0500        0.619        
  9.  80-159            0             -             -             -             0.0000        0.00%         -             -            
  10.  160-319           1             267.00        267           267           0.0002        2.04%         0.0100        1.618        
  11.  320-639           6             410.83        375           466           0.0011        12.24%        0.0200        0.990        
  12.  640-1279          2             1188.50       1174          1203          0.0004        4.08%         0.0100        0.634        
  13.  1280-2559         20            1446.30       1414          1448          0.0038        40.82%        0.0700        0.633        
  14.  2560-5119         0             -             -             -             0.0000        0.00%         -             -            
  15.  5120 and greater  0             -             -             -             0.0000        0.00%         -             -

参考