Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wireshark does a good job of extracting bittorrent PIECE messages sent to specific peers from other peers using a filter like the following e.g.: and ip.dst_host == and ip.src_host == 

I want automate the generation of a dump of this piece data for post/inline processing with a Python application e.g. graphing piece throughput against time with matplotlib.

Can someone tell me the tshark command-line arguments to achieve this assuming:

  • Input pcap file is input.pcap
  • Desired output is output.txt containing packet summary info followed by actual packet bytes as hex-array

As mentioned, I am planning to import output.txt into my Python analysis application, but also need the raw piece data to reassemble the pieces in Python for integrity checking. In my case the pieces are parts of a video. I can do the reassembly within Python no problem.

All I need is time offset, piece index, and the raw piece data which I have verified can be exported from within the Wireshark > Export dialog by selecting the Packet Summary and Packet Bytes options with the above filter in effect. I want to avoid having to do this export manually though for the many captures I have to make over the coming weeks and months.

Thanks in advance.

share|improve this question
Hmm, this could be as simple as: tshark -r input.cap -R ' and ip.dst_host == and ip.src_host ==' -T text – codeasone Aug 21 '10 at 23:10
up vote 2 down vote accepted

Looks like the following gets me most of the way to achieving what I am after in terms of automation facilities:

tshark -r 2-live.pcap -R ' and ip.dst_host ==' -T fields -e frame.number -e frame.time -e frame.len -e ip.src_host -e bittorrent.piece.index -e -E separator=+

Seems like I may not need to develop much of a Python utility after all. I can get per second BT payload stats with the following for example:

tshark -r 2-live.pcap -q -z io,stat,1," and ip.dst_host =="

Graphing off this data is going to be easy-peezy

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .