Re: Tshark output in apache log format

[Jeffs <jeffs () speakeasy net>]

  Hi Joke and thank you for your reply.  This prints out a text file, 
not a pcap standard file.  Well, it seems that way to me -- if I compare 
that outfile to a standard .cap file they are two totally different animals.

I think I need an output that is totally .pcap.

I could very possibly be wrong on all counts as I'm new to wireshark/tshark.

On 8/20/2010 11:03 AM, j.snelders wrote:
> Hi Jeffs,
>
> You can use a display filter -R "http.host contains "www"" and write the
> packets to -w outfile:
> $ tshark -r infile.pcap -R "http.host contains "www"" -w outfile.pcap
>
> Best regards
> Joke
>
> On Fri, 20 Aug 2010 09:55:26 -0400 Jeffs wrote:
> >   I doubt that Tshark can output a file in apache log format, but
> > another program, justniffer, can read a .cap file and output in apache
> > log format.
> >
> > I am currently using the following tshark command line to extract only
> > sessions with 'www.' in the link:
> >
> > tshark -r test.pcap -T fields -e http.host  | sed 's/?.*$//' | sed -n
> > '/www./p'  | sort | uniq -c | sort -rn | head -n 500
> >
> > but this output is not in apache log format for use by justniffer.
> >
> > Can someone suggest a method to:
> >
> > either use tshark to output in apache log format only data with "www."
> > in the data, or
> >
> > use a tshark command line sequence to output a "standard" .cap file that
> >
> > would contain all the usual .cap data but only for those records that
> > contain "www." in them.
> >
> > Thanks.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe