Wireshark · Wireshark-users: Re: [Wireshark-users] follow [tcp|ssl].stream with tshark

[miro.rovis@xxxxxxxxxxxxxxxxx]

Hi!

I've received no replied so far, and I believe this is something good to
do, so I'm trying again ;-) .

On 151119-13:29+0100, miro.rovis@xxxxxxxxxxxxxxxxx wrote:
> Hi!
> 
> I've been trying to get the streams, tcp or ssl, out with tshark,
> without success, for long.
> 
> The closest that I got to why it seems to not work is after I tried it
> with better scripts than I was able to write, so far:
> 
> Using Tshark To View Raw Socket Streams
> http://heapspray.net/post/using-tshark-to-view-raw-socket-streams/
> 
where you can still find the script that I based mine on.

And I enclose my script, too verbose for experts, but helpfully verbose
for people still getting their mind around traffic capture like me ;-)
... Look up the attached file:

tshark-streams.sh

I think I improved it with replacing the "| tr -d '=\r\n\t' " with
" | egrep '[[:print:]]'" .

It's the same trouble, though. There are no empty lines, because this
replacement prints out only the, you guessed it, printable chars out,
but:
> 
> In short, what I get in wireshark if I right click > Follow tcp|ssl
> stream (where window opens with that content) > Save 
> 
> is not the same, and can even be confusingly different from what I get
> with, picking up the line that does it in the script above:
> 
> tshark -r "$1" -T fields -e data -qz follow,tcp,raw,$i
> 
...

> 
> and working with net-analyzer/wireshark-1.12.8-r1, and trying to show it
> on concrete samples...
> 
> (On concrete samples), what I get with Wireshark, exactly as I explained
> in (pls. to cut the chase search for the string
> "dump_150927_1848_g0n_s09.dump"):
> 
> SSL Decode & My Hard-Earned Advice for SPDY/HTTP2 in Firefox
> https://forums.gentoo.org/viewtopic-t-1029408.html#7822484
> 
> is what you can download, follow the procedure in the above Gentoo
> Forums topic, in that post, and get the Javascript file plain out, with
> the file dump_150927_1848_g0n.dump from:
> http://www.CroatiaFidelis.hr/foss/cap/cap-150927-TLS-why-js/
> 
...

So these:
> 
> tshark -r dump_150927_1848_g0n.pcap -T fields -e data \
> 	-qz follow,tcp,raw,9 > dump_150927_1848_g0n_s09_TRY.bin
> tshark -r dump_150927_1848_g0n.pcap -T fields -e data -\
> 	qz follow,tcp,raw,9  | tr -d '=\r\n\t' > dump_150927_1848_g0n_s09_TRY_tr.bin
> tshark -r dump_150927_1848_g0n.pcap -T fields -e data \
> 	-qz follow,tcp,raw,9  | tr -d '=\r\n\t'  | xxd -r -p \
> 	> dump_150927_1848_g0n_s09_TRY_tr_xxd.bin
>
will now, with my script, if you run the script on that downloaded file
like this:

$ tshark-streams.sh  dump_150927_1848_g0n.pcap "tcp.stream eq 9"

it will verbosely tell you what it does (and it'll wait for you ti hit
Enter at the start, one and another time):

$dump.pcap: dump_150927_1848_g0n.pcap

$tshlog: tsh-151121_1220.log
-rw-r--r-- 1 miro miro 0 2015-11-21 12:20 tsh-151121_1220.log

STREAMS=$(tshark -r dump_150927_1848_g0n.pcap -2 -R "tcp.stream eq 9" -T
fields -e tcp.stream | sort -n | uniq)
$STREAMS: 9
INDEX=00009
Processing stream 00009 ...
tshark -r dump_150927_1848_g0n.pcap -T fields -e data -qz
follow,tcp,raw,9 | egrep '[[:print:]]' > dump_150927_1848_g0n_s00009.bin
tshark -r dump_150927_1848_g0n.pcap -qz follow,tcp,ascii,9 | egrep
'[[:print:]]' > dump_150927_1848_g0n_s00009.txt

tshark -r dump_150927_1848_g0n.pcap -T fields -e data -qz
follow,ssl,raw,9 | egrep '[[:print:]]' >
dump_150927_1848_g0n_s00009-ssl.bin
tshark -r dump_150927_1848_g0n.pcap -qz follow,ssl,ascii,9 | egrep
'[[:print:]]' > dump_150927_1848_g0n_s00009-ssl.txt

The new <...>.bin files that it got you, though:

> is never close to getting anything out of that stream...
>

> I uploaded what I got in:
> 
> http://www.CroatiaFidelis.hr/foss/cap/cap-150927-TLS-why-js/Add-151119/
>
(*Note*: you can also download tshark-streams.sh from there)

They don't have empty lines now, like those that I uploaded in the link
above, but it is not clear to me what they are, and how to get the real
content out of them.

> How to learn to do these things?

Regards!

-- 
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr

Attachment: tshark-streams.sh
Description: Bourne shell script

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAABCgAGBQJWUFB2AAoJEOqYhIhPuvCunGQP/3SLPJYMdZalA+IXmY4vGD3k
ywaeXFQrkXpyCFukWMDLEY/C23Vioq5mwZMX/pgZ16LYAXGHDwhEh7MMQ+kfpNzS
gpvHqEVkHvCYonscrQ7aWMrKADLOeMnXfQNipsPyucVfJ4/UG4uD9XgTftxzFE/a
AohHPgvKv5kmvQrtr4g5SjzzHRApWJ/Po/PSYJTTwhjnvUn3FrhgTTOHz7ayZ1Zd
354jQQesM9NYckQyX0uTnFF4GxKlsYYoGRoCv5KcmekMIoDeEy5NRWmhqP8De8AZ
/JBprtEa24Lm3kWVrE1ldR8fu0mC3CT0wzyOhz4GBiTmIZ05/1+221Uk2BTsUJnY
AYMKIiQhLeurUXGOV3dANFt7S21RpXsB/UH8qgbzLJ1+w0Bsdz61BFGZLSI6G7gn
OgOmfZF2HUdj4FQ6SHgPrWKrKoVBblK3YHATmxJwIrNaqUWECLVZRQhuPLSErSxI
ZwYUfu8FLAzg98jlKPRW5Ldqo5yGh/Z7Qlb9wwTkNCG0Nu3UUgf3z1SAbVCZlu8O
5+r54AjEyhOgRXmUaqvqXgWPUer617Xmmd8QD/npCV1ZKi9rFLrIN2OhVxBhzBl/
7KIO70DvjZNu26eE3k9ZNuiVh39axzGs+vpUgFBh5o8r5NdR/GVhWhNsvR7umKeN
MKDF3TBuyj0tXTvLRk/f
=oU1O
-----END PGP SIGNATURE-----

Attachment: signature.asc
Description: PGP signature