Wireshark · Wireshark-users: Re: [Wireshark-users] tshark conversatons

["j.snelders" <j.snelders@xxxxxxxxxx>]

Hi,

You can use the option -q (be more quiet on stout):

$ tshark -r test.pcap -q -z conv,tcp,tcp.port==80
================================================================================
TCP Conversations
Filter:tcp.port==80
                                               |       <-      | |      
->      | |     Total     |

                                               | Frames  Bytes | | Frames
 Bytes | | Frames  Bytes |

192.168.1.4:49380    <-> 62.69.179.205:80          49     57496      34 
    5023      83     62519
192.168.1.4:49376    <-> 62.69.179.205:80          50     58468      33 
    4981      83     63449
192.168.1.4:49401    <-> 194.17.45.181:80          49     69352      27 
    3992      76     73344
192.168.1.4:49404    <-> 8.12.214.126:80           34     46257      19 
    2292      53     48549

Best regards
Joan

On: Fri, 26 Feb 2010 15:11:14 +0100 fajfusio wrote:

>Hello
>How can I print the list of conversations contained in a file. E.g.
>I want to see conversations on a specific server port. I try something like:
tshark
>-z conv,tcp,"tcp.port==139" -r file.pcap Unfortunately it just prints the
>contents of a file. thank you for help
>