Tshark - Revision history

Busk at 18:32, 29 June 2024

2024-06-29T18:32:45Z

Busk at 21:26, 5 April 2024

2024-04-05T21:26:02Z

Busk at 21:07, 5 April 2024

2024-04-05T21:07:10Z

Busk at 14:49, 5 April 2024

2024-04-05T14:49:23Z

Busk at 14:40, 5 April 2024

2024-04-05T14:40:42Z

Busk at 14:39, 5 April 2024

2024-04-05T14:39:52Z

Busk at 14:36, 5 April 2024

2024-04-05T14:36:33Z

Busk at 02:55, 26 March 2024

2024-03-26T02:55:41Z

Busk at 20:58, 19 March 2024

2024-03-19T20:58:53Z

Busk at 00:28, 19 July 2023

2023-07-19T00:28:28Z

@@ Line 28: / Line 28: @@
 SNI capture on 3.x (note tls vs ssl)
 ```
-sudo tshark -l -i ens160 -f 'dst port ( 443 ) and host 10.250.183.88' -Y 'tls.handshake.extension.type == "server_name" || http.host' -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.host -e tls.handshake.extensions_server_name
+sudo tshark -l -i ens160 -f 'dst port ( 443 ) and host 10.x.x.y' -Y 'tls.handshake.extension.type == "server_name" || http.host' -T fields -e ip.src -e ip.dst -e tcp.dstport -e http.host -e tls.handshake.extensions_server_name
 # GRE

@@ Line 273: / Line 273: @@
 ```
 tshark -T pdml -i eth0
 ```

← Older revision		Revision as of 21:07, 5 April 2024
Line 268:		Line 268:
	tshark -i <interface> -Y "http" -T fields -e frame.number -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.host -e http.user_agent -e http.referer -e http.accept -e http.accept_language -e http.accept_encoding -e http.connection -e http.cookie -e http.cache_control -e http.authorization -e http.content_length -e http.content_type -e http.range -e http.accept_charset -e http.if_modified_since -e http.if_none_match -e http.if_range -e http.if_unmodified_since -e http.host -e http.location -e http.max_forwards -e http.pragma -e http.proxy_authorization -e http.range -e http.referer -e http.server -e http.te -e http.upgrade -e http.via -e http.warning -e http.www_authenticate -e http.x_forwarded_for		tshark -i <interface> -Y "http" -T fields -e frame.number -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.host -e http.user_agent -e http.referer -e http.accept -e http.accept_language -e http.accept_encoding -e http.connection -e http.cookie -e http.cache_control -e http.authorization -e http.content_length -e http.content_type -e http.range -e http.accept_charset -e http.if_modified_since -e http.if_none_match -e http.if_range -e http.if_unmodified_since -e http.host -e http.location -e http.max_forwards -e http.pragma -e http.proxy_authorization -e http.range -e http.referer -e http.server -e http.te -e http.upgrade -e http.via -e http.warning -e http.www_authenticate -e http.x_forwarded_for

		+	```
		+
		+	Decode real time (a lot of info)
		+	```
		+	tshark -T pdml -i eth0
	```		```

@@ Line 259: / Line 259: @@
   tshark -i any -f 'host 10.1.x.x' -Y 'http.request.method == "GET" or http.request.method == "POST"' -T fields -e http.request.method -e http.host -e http.request.uri -e http.user_agent -e http.referer -e http.accept -e http.accept_language -e http.accept_encoding -e http.connection -e http.cookie -e http.cache_control -e http.authorization -e http.content_length -e http.content_type
 ```
 All
 ```

@@ Line 258: / Line 258: @@
 ```
   tshark -i any -f 'host 10.1.x.x' -Y 'http.request.method == "GET" or http.request.method == "POST"' -T fields -e http.request.method -e http.host -e http.request.uri -e http.user_agent -e http.referer -e http.accept -e http.accept_language -e http.accept_encoding -e http.connection -e http.cookie -e http.cache_control -e http.authorization -e http.content_length -e http.content_type
 ```

@@ Line 253: / Line 253: @@
 # Headers
 ```
   tshark -i any -f 'host 10.1.x.x' -Y 'http.request.method == "GET" or http.request.method == "POST"' -T fields -e http.request.method -e http.host -e http.request.uri -e http.user_agent -e http.referer -e http.accept -e http.accept_language -e http.accept_encoding -e http.connection -e http.cookie -e http.cache_control -e http.authorization -e http.content_length -e http.content_type
 ```

@@ Line 250: / Line 250: @@
 ```
 tshark -l -i any -f 'port 443' -Y "ssl.handshake.ciphersuites" -T pdml | grep ssl.handshake.ciphersuite
 ```

← Older revision		Revision as of 02:55, 26 March 2024
Line 1:		Line 1:
		+	PCAP
		+	```
		+	tshark -l -i any -f 'host 10.x.x.x' -w 10.x.x.x.pcap
		+	```
		+
	HTTP 80		HTTP 80
	```		```

← Older revision		Revision as of 20:58, 19 March 2024
Line 1:		Line 1:
		+	HTTP 80
		+	```
		+	tshark -i any -f "port 80" -Y "http.request.method == GET \|\| http.request.method == POST"
		+	```
		+
	Decode tls/ssl		Decode tls/ssl
	```		```

@@ Line 6: / Line 6: @@
 syslog
 ```
-tshark -l -i any -f 'dst port ( 9514 ) and host log.mktp.io' -d tcp.port==9514,syslog -T fields -E separator="  " -e ip.src -e syslog.msg
+tshark -l -i any -f 'dst port ( 514 ) and host 10.x.x.x' -d tcp.port==514,syslog -T fields -E separator="  " -e ip.src -e ip.dst -e syslog.msg
 ```