1

Currently I do this to read a network capture file:

tshark -r myfile icmp

It prints only ICMP packets, which is a protocol on top of IP (not UDP or TCP).

But myfile is a large file with lots of HTTP traffic. I found that tshark takes a long time to process this file, and the reason is partly because it processes all the TCP packets fully, even dissecting the HTTP data. I realized this because it prints error messages related to HTTP dissection.

Since I know the ICMP packets I want are never inside TCP, I tried these:

tshark -r myfile 'not tcp and icmp'
tshark -r myfile -2 -R 'not tcp' icmp

But tshark still dissects HTTP packets (again I know this because I see HTTP dissector error messages).

I want to save time (and avoid crashes due to dissector bugs) by not dissecting higher-level protocols when a lower-level protocol does not match.

I am aware that I could split my capture files by protocol, but this is not so practical because the exact things I want to look at are not known in advance.

I also tried the -O option to enable specific dissectors, but this makes tshark print full multi-line details for each packet, which is not what I want.

How can I make tshark skip dissecting packets from specific lower-level protocols?

I am using tshark 1.10.6, but I could use newer versions if needed.

1

Your syntax isn't correct. It looks like you are mixing up Wireshark display filter syntax and pcap-filter capture filter syntax.

With the latest stable version of tshark (currently 2.4.0), you can specify a display filter to use with the -Y option. For example:

tshark -r myfile -Y "icmp"

The -Y option was available with version 1.10.6 as well.

Alternatively, you could use a read filter as follows, but I generally stick to the display filter method above:

tshark -r myfile -2R "icmp"
  • In my question I stated that the -2R approach does not work - it still dissects all the packets, even ones which are filtered out (e.g. not tcp still ends up dissecting HTTP packets). And my syntax is not wrong, it is the documentation you may be confused by, because man tshark claims the positional arguments are a capture filter, but in fact when reading from a file they are a display filter. – John Zwinck Aug 14 '17 at 0:48
  • Maybe the documentation isn't clear, but when reading from a file, the positional argument is a display filter, not a capture filter. You have a file already; therefore capture filters no longer apply, only read or display filters. See: code.wireshark.org/review/… In general, I always recommend upgrading to the latest available version, so maybe you want to try that and see if it behaves any differently. 1.10 went EOL over 2 years ago: wiki.wireshark.org/Development/LifeCycle – Christopher Maynard Aug 14 '17 at 2:06
  • I know that capture filters don't apply. I am not using capture filters. I am using display filters. – John Zwinck Aug 14 '17 at 5:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.