# yum install wireshark
# cd /usr/sbin
# sudo ./groupadd tshark
# sudo ./usermod -a -G tshark yangbongsoo
# sudo chgrp tshark /usr/sbin/dumpcap
# sudo chmod 750 /usr/sbin/dumpcap
# sudo ./setcap cap_net_raw,cap_net_admin=eip /usr/sbin/dumpcap
# sudo ./getcap /usr/sbin/dumpcap
/usr/sbin/dumpcap = cap_net_admin,cap_net_raw+eip
$ ./tshark -i eth0 -c 1 -q
Capturing on eth0
1 packet captured
$ ./tshark -V tcp port 80 -R "http.request || http.response" &
$ pstree -pa 'yangbongsoo'
nginx,155263
├─nginx,155264
├─nginx,155265
├─nginx,155266
└─nginx,155267
bash,109967
├─pstree,110571 -pa yangbongsoo
└─tshark,110535 -V tcp port 80 -R http.request\040||\040http.response
└─dumpcap,110538 -n -i eth0 -f tcp\040port\04080 -Z none
$ ./tshark -D
1. eth0
2. nflog (Linux netfilter log (NFLOG) interface)
3. nfqueue (Linux netfilter queue (NFQUEUE) interface)
4. any (Pseudo-device that captures on all interfaces)
5. lo
$ ./tshark -i eth0 -c 2
Capturing on eth0
0.000000000 10.xxx.xxx.xxx -> 10.xxx.xxx.xxx TCP 1012 45850 > biimenu [PSH, ACK] Seq=1 Ack=1 Win=501 Len=946 TSval=1734909355 TSecr=856327483
0.002694435 10.xxx.xxx.xxx -> 10.xxx.xxx.xxx TCP 66 biimenu > 45850 [ACK] Seq=1 Ack=947 Win=501 Len=0 TSval=856417489 TSecr=1734909355
2 packets captured
$ ./tshark -f "tcp port 80" -i eth0
$ ./tshark -f "tcp port 80" -i eth0 -R "http.request || http.response" -V
$ ./tshark -f "tcp port 80" -i eth0 -R "http.request || http.response" -V | grep "Hypertext Transfer Protocol" -A 21
--
Hypertext Transfer Protocol
GET /api/static/real.js HTTP/1.1\r\n
[Expert Info (Chat/Sequence): GET /api/static/real.js HTTP/1.1\r\n]
[Message: GET /api/static/real.js HTTP/1.1\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: GET
Request URI: /api/static/real.js
Request Version: HTTP/1.1
CHECK: check\r\n
Host: 10.xxx.xxx.xxx\r\n
Connection: close\r\n
Pragma: no-cache\r\n
Cache-Control: no-cache\r\n
Upgrade-Insecure-Requests: 1\r\n
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36\r\n
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\n
Accept-Encoding: gzip, deflate\r\n
Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7\r\n
\r\n
[Full request URI: http://10.xxx.xxx.xxx/api/static/real.js]
--
Hypertext Transfer Protocol
HTTP/1.1 200 OK\r\n
[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]
[Message: HTTP/1.1 200 OK\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Version: HTTP/1.1
Status Code: 200
Response Phrase: OK
Server: nginx\r\n
Date: Thu, 11 Jan 2018 06:23:28 GMT\r\n
Content-Type: application/javascript; charset=UTF-8\r\n
Transfer-Encoding: chunked\r\n
Connection: close\r\n
X-Powered-By: Express\r\n
Access-Control-Allow-Origin: http://node.test.com\r\n
Vary: Origin\r\n
Access-Control-Allow-Credentials: true\r\n
Cache-Control: public, max-age=0\r\n
Last-Modified: Thu, 21 Dec 2017 07:03:54 GMT\r\n
ETag: W/"14856f-16077e2b57a"\r\n
Content-Encoding: gzip\r\n
--
$ ./tshark -G | cut -f3 | grep "^http\."
http.notification
http.response
http.request
http.authbasic
http.request.method
http.request.uri
http.request.version
http.request.full_uri
http.response.code
http.response.phrase
http.authorization
http.proxy_authenticate
http.proxy_authorization
http.proxy_connect_host
http.proxy_connect_port
http.www_authenticate
http.content_type
http.content_length_header
http.content_length
http.content_encoding
http.transfer_encoding
http.upgrade
http.user_agent
http.host
http.connection
http.cookie
http.accept
http.referer
http.accept_language
http.accept_encoding
http.date
http.cache_control
http.server
http.location
http.sec_websocket_accept
http.sec_websocket_extensions
http.sec_websocket_key
http.sec_websocket_protocol
http.sec_websocket_version
http.set_cookie
http.last_modified
http.x_forwarded_for
$ ./tshark -r ~/tshark-log/temp.pcap -q -z "conv,ip,ip.addr==10.xxx.xxx.xxx" -w ~/tshark-log/write.pcap
================================================================================
IPv4 Conversations
Filter:ip.addr==10.xxx.xxx.xxx
| <- | | -> | | Total | Rel. Start | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | | |
10.xxx.xxx.xxx <-> 10.10.10.10 207 14144 80 371276 287 385420 4.065868087 0.0994
10.xxx.xxx.xxx <-> 10.10.10.10 44 382591 39 3071 83 385662 4.069769413 0.0772
10.10.10.10 <-> 10.xxx.xxx.xxx 8 11380 10 668 18 12048 11.738211339 0.0106
10.xxx.xxx.xxx <-> 10.10.10.10 7 595 6 11248 13 11843 11.731682788 0.0066
10.10.10.10 <-> 10.xxx.xxx.xxx 1 1012 1 66 2 1078 4.220985502 0.0028
10.xxx.xxx.xxx <-> 10.10.10.10 1 90 1 90 2 180 4.051242000 0.0008
10.xxx.xxx.xxx <-> 10.10.10.10 1 106 0 0 1 106 15.104299993 0.0000
================================================================================
-q : be more quiet on stdout (e.g. when using statistics)
-z <statistics> various statistics, see the man page for details
-r <infile> set the filename to read from (no stdin!)
-w <outfile|-> write packets to a pcap-format file named "outfile"
(or to the standard output for "-")
$ ./capinfos ~/tshark-log/write.pcap
File name: /home/yangbongsoo/tshark-log/temp.pcap
File type: Wireshark - pcapng
File encapsulation: Ethernet
Packet size limit: file hdr: (not set)
Number of packets: 467
File size: 817148 bytes
Data size: 801043 bytes
Capture duration: 15 seconds
Start time: Thu Jan 11 16:10:34 2018
End time: Thu Jan 11 16:10:49 2018
Data byte rate: 53034.10 bytes/sec
Data bit rate: 424272.82 bits/sec
Average packet size: 1715.30 bytes
Average packet rate: 30.92 packets/sec
SHA1: df7f85751dd2d56d8a1b64a28b93b30553df6a08
RIPEMD160: k37d0ccd2b20s81s6d9da4b44d3d168sc98s1aca
MD5: 1q908e9a36cn382l768s95w4k6c8w6kb
Strict time order: True
$ ./tshark -o column.format:'" Source","%s","Destination","%d", "dstport", "%uD", "Protocol", "%p"' -r ~/tshark-log/temp.pcap -R "ip.src == 10.xxx.xxx.xxx && ! dns && tcp.dstport != 80 && tcp.dstport != 443" | sort -u
10.xxx.xxx.xxx -> 10.10.10.10 9973 TCP
10.xxx.xxx.xxx -> 10.10.10.10 18000 TCP
10.xxx.xxx.xxx -> 10.10.10.10 59048 HTTP
10.xxx.xxx.xxx -> 10.10.10.10 59048 TCP
Hmm.
tshark -Fshows the options, and for a master build I get:Interesting - you're right, same for me. I always use "libpcap" and it still seems to work. But "pcap" also works. I think older versions only had "libpcap" as parameter option.
So maybe @met1366 needs to upgrade his tshark binaries.
The problem was I had tshark version 1.10.6 which had a bug not to capture pcap file! I've already upgraded to latest version and now it's fixed.
Thanks
You can use either pcap or libpcap since this commit.