使用 tshark 过滤 PCAP 文件：show ip source>ip destination:info in a txt file

Question

I need a tshark command so i can create a txt file containing Ipsource>Ipdestination:Info in this order ! i tried this command tshark -T fields -n -r "C:\Users\dell\Desktop\tracecomplete.pcap" -E separator=, -e ip.src -e ip.dst > "C:\Users\dell\Desktop\walima22.txt"*

but i can't change the separator and show the infos

Answer 1

There are generally 2 solutions for printing specific column data, one using column-specifiers and the other using fields, similar to what you have.

Using column-specifiers:

Standard specifiers as described by tshark.exe -G column-formats :

tshark.exe -n -r "C:\Users\dell\Desktop\tracecomplete.pcap" -o "gui.column.format:\"Source\",\"%s\",\"Destination\",\"%d\",\"Info\",\"%i\""

... or using custom columns for those fields that are supported:

tshark.exe -n -r "C:\Users\dell\Desktop\tracecomplete.pcap" -o "gui.column.format:\"Source\",\"%Cus:ip.src\",\"Destination\",\"%Cus:ip.dst\",\"Info\",\"%i\""

---

Using Fields:

tshark.exe -n -r "C:\Users\dell\Desktop\tracecomplete.pcap" -T fields -E separator=, -e ip.src -e ip.dst -e _ws.col.Info

---

but i can't change the separator
You should be able to change it using the -E option. Refer to the tshark man page for more help with this option.