3

Wireshark does a good job of extracting bittorrent PIECE messages sent to specific peers from other peers using a filter like the following e.g.:

bittorrent.piece.data and ip.dst_host == 192.168.3.14 and ip.src_host == 192.168.3.15 

I want automate the generation of a dump of this piece data for post/inline processing with a Python application e.g. graphing piece throughput against time with matplotlib.

Can someone tell me the tshark command-line arguments to achieve this assuming:

  • Input pcap file is input.pcap
  • Desired output is output.txt containing packet summary info followed by actual packet bytes as hex-array

As mentioned, I am planning to import output.txt into my Python analysis application, but also need the raw piece data to reassemble the pieces in Python for integrity checking. In my case the pieces are parts of a video. I can do the reassembly within Python no problem.

All I need is time offset, piece index, and the raw piece data which I have verified can be exported from within the Wireshark > Export dialog by selecting the Packet Summary and Packet Bytes options with the above filter in effect. I want to avoid having to do this export manually though for the many captures I have to make over the coming weeks and months.

Thanks in advance.

1
  • Hmm, this could be as simple as: tshark -r input.cap -R 'bittorrent.piece.data and ip.dst_host == 192.168.3.14 and ip.src_host == 192.168.3.15' -T text
    – codeasone
    Aug 21, 2010 at 23:10

1 Answer 1

2

Looks like the following gets me most of the way to achieving what I am after in terms of automation facilities:

tshark -r 2-live.pcap -R 'bittorrent.piece.data and ip.dst_host == 192.168.3.15' -T fields -e frame.number -e frame.time -e frame.len -e ip.src_host -e bittorrent.piece.index -e bittorrent.piece.data -E separator=+

Seems like I may not need to develop much of a Python utility after all. I can get per second BT payload stats with the following for example:

tshark -r 2-live.pcap -q -z io,stat,1,"bittorrent.piece.data and ip.dst_host == 192.168.3.15"

Graphing off this data is going to be easy-peezy

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .