-
+ic
=head1 NAME
tshark - Dump and analyze network traffic
S<[ B<-T> pdml|psml|ps|text|fields ]>
S<[ B<-v> ]>
S<[ B<-V> ]>
+S<[ B<-O> E<lt>protocolsE<gt> ]>
S<[ B<-w> E<lt>outfileE<gt>|- ]>
S<[ B<-W> E<lt>file format optionE<gt>]>
S<[ B<-x> ]>
them, rather than writing packets from a saved capture file, it won't
show the "frame number" field. If the B<-V> option is specified, it
writes instead a view of the details of the packet, showing all the
-fields of all protocols in the packet.
+fields of all protocols in the packet. If the B<-O> option is
+specified in combination with B<-V>, it will only show the full
+protocols specified. Use the output of "tshark -G protocols" to
+find the abbrevations of the protocols you can specify.
If you want to write the decoded form of packets to a file, run
B<TShark> without the B<-w> option, and redirect its standard output to
Windows. It is not available on UNIX systems with earlier versions of
libpcap.
+This option can occur multiple times. If used before the first
+occurrence of the B<-i> option, it sets the default capture buffer size.
+If used after an B<-i> option, it sets the capture buffer size for
+the interface specified by the last B<-i> option occurring before
+this option. If the capture buffer size is not set specifically,
+the default capture buffer size is used if provided.
+
=item -c E<lt>capture packet countE<gt>
Set the maximum number of packets to read when capturing live
Set the capture filter expression.
+This option can occur multiple times. If used before the first
+occurrence of the B<-i> option, it sets the default capture filter expression.
+If used after an B<-i> option, it sets the capture filter expression for
+the interface specified by the last B<-i> option occurring before
+this option. If the capture filter expression is not set specifically,
+the default capture filter expression is used if provided.
+
=item -F E<lt>file formatE<gt>
Set the file format of the output capture file written using the B<-w>
read data from the standard input. Data read from pipes must be in
standard libpcap format.
+This option can occur multiple times. When capturing from multiple
+interfaces, the capture file will be saved in pcap-ng format.
+
Note: the Win32 version of B<TShark> doesn't support capturing from
pipes!
if you are capturing in monitor mode and are not connected to another
network with another adapter.
+This option can occur multiple times. If used before the first
+occurrence of the B<-i> option, it enables the monitor mode for all interfaces.
+If used after an B<-i> option, it enables the monitor mode for
+the interface specified by the last B<-i> option occurring before
+this option.
+
=item -K E<lt>keytabE<gt>
Load kerberos crypto keys from the specified keytab file.
broadcast traffic, and multicast traffic to addresses received by that
machine.
+This option can occur multiple times. If used before the first
+occurrence of the B<-i> option, no interface will be put into the
+promiscuous mode.
+If used after an B<-i> option, the interface specified by the last B<-i>
+option occurring before this option will not be put into the
+promiscuous mode.
+
=item -q
When capturing packets, don't display the continuous count of packets
memory, or saved to disk. A value of 0 specifies a snapshot length of
65535, so that the full packet is captured; this is the default.
+This option can occur multiple times. If used before the first
+occurrence of the B<-i> option, it sets the default snapshot length.
+If used after an B<-i> option, it sets the snapshot length for
+the interface specified by the last B<-i> option occurring before
+this option. If the snapshot length is not set specifically,
+the default snapshot length is used if provided.
+
=item -S
Decode and display packets even while writing raw packet data using the
Set the data link type to use while capturing packets. The values
reported by B<-L> are the values that can be used.
+This option can occur multiple times. If used before the first
+occurrence of the B<-i> option, it sets the default capture link type.
+If used after an B<-i> option, it sets the capture link type for
+the interface specified by the last B<-i> option occurring before
+this option. If the capture link type is not set specifically,
+the default capture link type is used if provided.
+
=item -z E<lt>statisticsE<gt>
Get B<TShark> to collect various types of statistics and display the result
This option can be used multiple times on the command line.
+=item B<-z> icmpv6,srt[,I<filter>]
+
+Compute total ICMPv6 echo requests, replies, loss, and percent loss, as well as
+minimum, maximum, mean, median and sample standard deviation SRT statistics
+typical of what ping provides.
+
+Example: S<B<-z icmpv6,srt,ipv6.src==fe80::1>> will collect ICMPv6 SRT statistics
+for ICMPv6 echo request packets originating from a specific host.
+
+This option can be used multiple times on the command line.
+
=item B<-z> io,phs[,I<filter>]
Create Protocol Hierarchy Statistics listing both number of packets and bytes.
Collect packet/bytes statistics for the capture in intervals of
I<interval> seconds. I<Interval> can be specified either as a whole or
-fractional second and can be specified with ms resolution.
+fractional second and can be specified with microsecond (us) resolution.
If I<interval> is 0, the statistics will be calculated over all packets.
If no I<filter> is specified the statistics will be calculated for all packets.
which only calculates the number of packets and bytes in each interval.
B<io,stat> can also do much more statistics and calculate COUNT(), SUM(),
-MIN(), MAX(), and AVG() using a slightly different filter syntax:
+MIN(), MAX(), AVG() and LOAD() using a slightly different filter syntax:
- [COUNT|SUM|MIN|MAX|AVG](<field>)<filter>
+=item -z io,stat,E<34>[COUNT|SUM|MIN|MAX|AVG|LOAD](I<field>)I<field> [and I<filter>]E<34>
NOTE: One important thing to note here is that the field that the
calculation is based on MUST also be part of the filter string or
decimal separator is set to "."! If it is set to "," the statistics
will not be displayed per filter.
-COUNT(<field>) can be used on any type which has a display filter name.
-It will count how many times this particular field is encountered in the
-filtered packet list.
+B<COUNT(I<field>)I<field> [and I<filter>]> - Calculates the number of times that the
+field I<name> (not its value) appears per interval in the filtered packet list.
+''I<field>'' can be any display filter name.
-Example: B<-z io,stat,0.010,COUNT(smb.sid)smb.sid>
+Example: B<-z io,stat,0.010,E<34>COUNT(smb.sid)smb.sidE<34>>
This will count the total number of SIDs seen in each 10ms interval.
-SUM(<field>) can only be used on named fields of integer type.
-This will sum together every occurrence of this field's value for each interval.
-
-Example: B<-z io,stat,0.010,SUM(frame.pkt_len)frame.pkt_len>
-
-This will report the total number of bytes seen in all the packets within
-an interval.
-
-MIN/MAX/AVG(<field>) can only be used on named fields that are either
-integers or relative time fields. This will calculate maximum/minimum
-or average seen in each interval. If the field is a relative time field
-the output will be presented in seconds and three digits after the
-decimal point. The resolution for time calculations is 1ms and anything
-smaller will be truncated.
-
-Example: B<-z "io,stat,0.010,smb.time&&ip.addr==1.1.1.1,MIN(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1">
-
-This will calculate statistics for all smb response times we see to/from
-host 1.1.1.1 in 10ms intervals. The output will be displayed in 4
-columns; number of packets/bytes, minimum response time, maximum response
-time and average response time.
+B<SUM(I<field>)I<field> [and I<filter>]> - Unlike COUNT, the I<values> of the
+specified field are summed per time interval.
+''I<field>'' can only be a named integer or relative time field.
+
+Example: B<-z io,stat,0.010,E<34>SUM(frame.len)frame.lenE<34>>
+
+Reports the total number of bytes that were transmitted bidirectionally in
+all the packets within a 10 millisecond interval.
+
+B<MIN/MAX/AVG(I<field>)I<field> [and I<filter>]> - The minimum, maximum, or average field value
+in each interval is calculated. The specified field must be a named integer
+or relative time field. For relative time fields, the output is presented in
+seconds with six decimal digits of precision rounded to the nearest microsecond.
+
+In the following example, The time of the first Read_AndX call, the last Read_AndX
+response values are displayed and the minimum, maximum, and average Read response times
+(SRTs) are calculated. NOTE: If the DOS command shell line continuation character, ''^''
+is used, each line cannot end in a comma so it is placed at the beginning of each
+continuation line:
+
+ tshark -o tcp.desegment_tcp_streams:FALSE -n -q -r smb_reads.cap -z io,stat,0,
+ "MIN(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==0",
+ "MAX(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==1",
+ "MIN(smb.time)smb.time and smb.cmd==0x2e",
+ "MAX(smb.time)smb.time and smb.cmd==0x2e",
+ "AVG(smb.time)smb.time and smb.cmd==0x2e"
+
+
+ ======================================================================================================
+ IO Statistics
+ Column #0: MIN(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==0
+ Column #1: MAX(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==1
+ Column #2: MIN(smb.time)smb.time and smb.cmd==0x2e
+ Column #3: MAX(smb.time)smb.time and smb.cmd==0x2e
+ Column #4: AVG(smb.time)smb.time and smb.cmd==0x2e
+ | Column #0 | Column #1 | Column #2 | Column #3 | Column #4 |
+ Time | MIN | MAX | MIN | MAX | AVG |
+ 000.000- 0.000000 7.704054 0.000072 0.005539 0.000295
+ ======================================================================================================
+
+The following command displays the average SMB Read response PDU size, the
+total number of read PDU bytes, the average SMB Write request PDU size, and
+the total number of bytes transferred in SMB Write PDUs:
+
+ tshark -n -q -r smb_reads_writes.cap -z io,stat,0,
+ "AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to",
+ "SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to",
+ "AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to",
+ "SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to"
+
+ =====================================================================================
+ IO Statistics
+ Column #0: AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to
+ Column #1: SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to
+ Column #2: AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to
+ Column #3: SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to
+ | Column #0 | Column #1 | Column #2 | Column #3 |
+ Time | AVG | SUM | AVG | SUM |
+ 000.000- 30018 28067522 72 3240
+ =====================================================================================
+
+B<LOAD(I<field>)I<field> [and I<filter>]> - The LOAD/Queue-Depth
+in each interval is calculated. The specified field must be a relative-time filed that represents a response time. For example smb.time.
+For each interval the Queue-Depth for the specified protocol is calculated.
+
+The following command displays the average SMB LOAD.
+A value of 1.0 represents one I/O in flight.
+
+ tshark -n -q -r smb_reads_writes.cap
+ -z "io,stat,0.001,LOAD(smb.time)smb.time"
+
+ ============================================================================
+ IO Statistics
+ Interval: 0.001000 secs
+ Column #0: LOAD(smb.time)smb.time
+ | Column #0 |
+ Time | LOAD |
+ 0000.000000-0000.001000 1.000000
+ 0000.001000-0000.002000 0.741000
+ 0000.002000-0000.003000 0.000000
+ 0000.003000-0000.004000 1.000000
+
+
+
+B<FRAMES | BYTES[()I<filter>]> - Displays the total number of frames or bytes.
+The filter field is optional but if included it must be prepended with ''()''.
+
+The following command displays five columns: the total number of frames and bytes
+(transferred bidirectionally) using a single comma, the same two stats using the FRAMES and BYTES
+subcommands, the total number of frames containing at least one SMB Read response, and
+the total number of bytes transmitted to the client (unidirectionally) at IP address 10.1.0.64.
+
+ tshark -o tcp.desegment_tcp_streams:FALSE -n -q -r smb_reads.cap -z io,stat,0,,FRAMES,BYTES,
+ "FRAMES()smb.cmd==0x2e and smb.response_to","BYTES()ip.dst==10.1.0.64"
+
+ =======================================================================================================================
+ IO Statistics
+ Column #0:
+ Column #1: FRAMES
+ Column #2: BYTES
+ Column #3: FRAMES()smb.cmd==0x2e and smb.response_to
+ Column #4: BYTES()ip.dst==10.1.0.64
+ | Column #0 | Column #1 | Column #2 | Column #3 | Column #4 |
+ Time | Frames | Bytes | FRAMES | BYTES | FRAMES | BYTES |
+ 000.000- 33576 29721685 33576 29721685 870 29004801
+ =======================================================================================================================
=item B<-z> conv,I<type>[,I<filter>]
Example: B<-z "sip,stat,ip.addr==1.2.3.4"> will only collect stats for
SIP packets exchanged by the host at IP address 1.2.3.4 .
+=item B<-z> mac-lte,stat[I<,filter>]
+
+This option will activate a counter for LTE MAC messages. You will get
+information about the maximum number of UEs/TTI, common messages and
+various counters for each UE that appears in the log.
+
+Example: B<-z mac-lte,stat>.
+
+This option can be used multiple times on the command line.
+
+If the optional I<filter> is provided, the stats will only be calculated
+for those frames that match that filter.
+Example: B<-z "mac-lte,stat,mac-lte.rnti>3000"> will only collect stats for
+UEs with an assigned RNTI whose value is more than 3000.
+
+=item B<-z> rlc-lte,stat[I<,filter>]
+
+This option will activate a counter for LTE RLC messages. You will get
+information about common messages and various counters for each UE that appears
+in the log.
+
+Example: B<-z rlc-lte,stat>.
+
+This option can be used multiple times on the command line.
+
+If the optional I<filter> is provided, the stats will only be calculated
+for those frames that match that filter.
+Example: B<-z "rlc-lte,stat,rlc-lte.ueid>3000"> will only collect stats for
+UEs with a UEId of more than 3000.
+
=back
=back
git.samba.org / obnox / wireshark / wip.git / blobdiff