Currently I do this to read a network capture file:
tshark -r myfile icmp
It prints only ICMP packets, which is a protocol on top of IP (not UDP or TCP).
myfile is a large file with lots of HTTP traffic. I found that
tshark takes a long time to process this file, and the reason is partly because it processes all the TCP packets fully, even dissecting the HTTP data. I realized this because it prints error messages related to HTTP dissection.
Since I know the ICMP packets I want are never inside TCP, I tried these:
tshark -r myfile 'not tcp and icmp' tshark -r myfile -2 -R 'not tcp' icmp
But tshark still dissects HTTP packets (again I know this because I see HTTP dissector error messages).
I want to save time (and avoid crashes due to dissector bugs) by not dissecting higher-level protocols when a lower-level protocol does not match.
I am aware that I could split my capture files by protocol, but this is not so practical because the exact things I want to look at are not known in advance.
I also tried the
-O option to enable specific dissectors, but this makes
tshark print full multi-line details for each packet, which is not what I want.
How can I make
tshark skip dissecting packets from specific lower-level protocols?
I am using tshark 1.10.6, but I could use newer versions if needed.