Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Wireshark does a good job of extracting bittorrent PIECE messages sent to specific peers from other peers using a filter like the following e.g.:

bittorrent.piece.data and ip.dst_host == 192.168.3.14 and ip.src_host == 192.168.3.15 

I want automate the generation of a dump of this piece data for post/inline processing with a Python application e.g. graphing piece throughput against time with matplotlib.

Can someone tell me the tshark command-line arguments to achieve this assuming:

  • Input pcap file is input.pcap
  • Desired output is output.txt containing packet summary info followed by actual packet bytes as hex-array

As mentioned, I am planning to import output.txt into my Python analysis application, but also need the raw piece data to reassemble the pieces in Python for integrity checking. In my case the pieces are parts of a video. I can do the reassembly within Python no problem.

All I need is time offset, piece index, and the raw piece data which I have verified can be exported from within the Wireshark > Export dialog by selecting the Packet Summary and Packet Bytes options with the above filter in effect. I want to avoid having to do this export manually though for the many captures I have to make over the coming weeks and months.

Thanks in advance.

share|improve this question
    
Hmm, this could be as simple as: tshark -r input.cap -R 'bittorrent.piece.data and ip.dst_host == 192.168.3.14 and ip.src_host == 192.168.3.15' -T text –  codeitagile Aug 21 '10 at 23:10

1 Answer 1

up vote 2 down vote accepted

Looks like the following gets me most of the way to achieving what I am after in terms of automation facilities:

tshark -r 2-live.pcap -R 'bittorrent.piece.data and ip.dst_host == 192.168.3.15' -T fields -e frame.number -e frame.time -e frame.len -e ip.src_host -e bittorrent.piece.index -e bittorrent.piece.data -E separator=+

Seems like I may not need to develop much of a Python utility after all. I can get per second BT payload stats with the following for example:

tshark -r 2-live.pcap -q -z io,stat,1,"bittorrent.piece.data and ip.dst_host == 192.168.3.15"

Graphing off this data is going to be easy-peezy

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.