Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using tshark to dump bittorrent.piece.data and appear to have hit some internal limit within tshark.

tshark -r 2-live.pcap -R "bittorrent.piece.data and ip.dst_host == 192.168.3.14" -T fields bittorrent.piece.data > dumped

This should dump the piece data (32Kbyte pieces) as colon separated bytes in hex without leading 0x so for example: 7f:00:ab:cd.... and so on for 32Kbytes.

One piece is written to the stdout per line which I am simply redirecting to a file, but the piece data is truncated somehow to a line length of 65540, where I am expecting 90-100KBytes per line/piece, given the 3 characters-per-byte required by the output format chosen by tshark (7f: == 1 byte)

Running with strace I can see that tshark is writing 4096 bytes and then 61444 for each piece.

I don't know if this is a hard-wired limitation of tshark with regard to outputing fields of a protocol read from a pcap file, or whether my Linux configuration is limiting this at a lower-level. I strongly expect it is the former but would welcome advice.

Do I need to patch wireshark/tshark code or is there command-line or configuration option I am missing?

Note: I can successfully dump 32768 KBytes payload data from the GUI wireshark tool so the data is definitely in the pcap file. But I am keen to automate this process and need tshark to give me all the bytes...

share|improve this question
up vote 0 down vote accepted

I'd rather suggest you to write raw packet data to a file with -w tshark switch (which should work fine) and then convert them to your desired format with hexdump -v -e '1/1 "%02x:"' <dump.raw >dump.hex.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .