TShark output redirection

Question

I am using TShark command line in order to start new capture. If I use this command tshark.exe -w C:\test.pcap -i (my interface number) I save the capture on my hard drive and this is what need, but the output of this command shows the number of packets received, number that is updating all the time and this output I cannot get.

With this command: tshark.exe -i (my interface number) I can see the packet details, and I can get the process output in order to show it on my form (win form), and until now I could not find any command that would show me the packet details and save the capture file on my hard drive. If I use this command: tshark.exe -i (my interface number) -w C:\test.pcap I can save the capture but the output is like in the first example without the packet details. Maybe someone can help me with this?

Mike Mackintosh · Accepted Answer · 2012-09-26 21:25:13Z

3

Use the -V flag.

This enables verbose mode.

I would recommend this along with -x depending on the intensity and level of logging required.

answered Sep 26, 2012 at 21:25

Mike Mackintosh

14.3k7 gold badges64 silver badges87 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

Mike Mackintosh Over a year ago

tshark.exe -i (int_number) -V -x -w C:\test.pcap should do the trick. Just tried it out on a Windows XP machine and worked.

Dana Yeger Over a year ago

first of all thanks, now i can see that the output of this command is all the packet details and only the ip and the protocol, is it possibly this output: 1.343007 192.168.0.100 -> 69.169.160.101 UDP 62 Source port: 62587 Destination port: 49500 without all the details ?

Mike Mackintosh Over a year ago

-x is supposed to output the ASCII/HEX packet data. Leave off the -V and try again.

Dana Yeger Over a year ago

still all the details, without -V and without -x

Mike Mackintosh Over a year ago

Hmm.. strange. Are you on Win Vista+? Try tshark.exe -i int -xqPlns 1500 > C:\text.pcap

|

user340140 · Accepted Answer · 2012-09-26 21:26:38Z

3

tshark seems to be "tcpdump for windows"

you've got 2 options

1: modify tshark for your purpose (you'll probably need to know how to program in C)

2: write the raw output to a pipe and TEE it to a file and to your application. (or have your application read the pipe ans write the file)

answered Sep 26, 2012 at 21:26

user340140

6886 silver badges10 bronze badges

1 Comment

nephewtom Over a year ago

How would you do option 2? I've tried, but with no luck: stackoverflow.com/questions/26177333/…

Collectives™ on Stack Overflow

TShark output redirection

2 Answers 2

10 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

10 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related