tshark: display filters + reporting using csv

You can do pretty nifty things with tshark. The absolute life saver is thsark's ability to dump to a csv/tsv file using a user specified display filter.

As an example, I'd like to point out some packet retransmission issues to my provider in a nice (manager friendly) spreadsheet.  Here we go:

Manager friendly output:

ip.src	tcp.srcport	ip.dst	tcp.dstport	tcp.flags.syn	tcp.flags.ack	tcp.flags.push	tcp.flags.reset	tcp.analysis.bytes_in_flight	tcp.len
a.b.c.d	8645	e.f.g.h7	9999	1	0	0	0		0
e.f.g.h7	9999	a.b.c.d	8645	1	1	0	0		0
a.b.c.d	8645	e.f.g.h7	9999	0	1	0	0		0
a.b.c.d	8645	e.f.g.h7	9999	0	1	1	0	168	168
e.f.g.h7	9999	a.b.c.d	8645	0	1	0	0		0
e.f.g.h7	9999	a.b.c.d	8645	0	1	1	0	1154	1154
a.b.c.d	8645	e.f.g.h7	9999	0	1	0	0		0
a.b.c.d	8645	e.f.g.h7	9999	0	1	0	0	1448	1448
a.b.c.d	8645	e.f.g.h7	9999	0	1	1	0	1502	54
e.f.g.h7	9999	a.b.c.d	8645	0	1	0	0		0

How do we get there?
1. Identify the fields that you want. A wireshark display filter cheat-sheet is a good place to start. You can home in on the fields that you want by firing up Wireshark and using the expression builder (button right next to the filter input box) then selecting the protocol that you want.

2. Choose your TCP stream.

	# Viewing the tcp conversations in a pcap
	tshark -qn -z conv,tcp -r test.pcap
	================================================================================
	TCP Conversations
	Filter:<No Filter>
	| <- | | -> | | Total | Relative | Duration |
	| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
	a.b.c.d:31822 <-> e.f.g.h:9999 553 91298 549 36234 1102 127532 0.000000000 5155.6751
	a.b.c.d:8645 <-> e.f.g.h:9999 402 66141 402 28210 804 94351 5162.869498000 3715.2102

view raw tcp_conversations.sh hosted with ❤ by GitHub

3. Assemble your command. The one used to display the output above is:

	# First 10 packets of the second TCP stream in the pcap
	# Comman separated values with a header for the specified fields
	$ tshark -ntu -r test.pcap -Y tcp.stream==1 -c 10 \
	-E header=y -Tfields -E separator="," \
	-e ip.src \
	-e tcp.srcport \
	-e "ip.dst" \
	-e tcp.dstport \
	-e tcp.flags.syn \
	-e tcp.flags.ack \
	-e tcp.flags.push \
	-e tcp.flags.reset \
	-e tcp.analysis.bytes_in_flight \
	-e tcp.len
	# Piping the output of the previous command to the csvlook command yields a nice table that can be easily grokked on the shell
	|----------+-------------+---------+-------------+---------------+---------------+----------------+-----------------+------------------------------+----------|
	| ip.src | tcp.srcport | ip.dst | tcp.dstport | tcp.flags.syn | tcp.flags.ack | tcp.flags.push | tcp.flags.reset | tcp.analysis.bytes_in_flight | tcp.len |
	|----------+-------------+---------+-------------+---------------+---------------+----------------+-----------------+------------------------------+----------|
	| a.b.c.d | 8645 | e.f.g.h | 9999 | 1 | 0 | 0 | 0 | | 0 |
	| e.f.g.h | 9999 | a.b.c.d | 8645 | 1 | 1 | 0 | 0 | | 0 |
	| a.b.c.d | 8645 | e.f.g.h | 9999 | 0 | 1 | 0 | 0 | | 0 |
	| a.b.c.d | 8645 | e.f.g.h | 9999 | 0 | 1 | 1 | 0 | 168 | 168 |
	| e.f.g.h | 9999 | a.b.c.d | 8645 | 0 | 1 | 0 | 0 | | 0 |
	| e.f.g.h | 9999 | a.b.c.d | 8645 | 0 | 1 | 1 | 0 | 1154 | 1154 |
	| a.b.c.d | 8645 | e.f.g.h | 9999 | 0 | 1 | 0 | 0 | | 0 |
	| a.b.c.d | 8645 | e.f.g.h | 9999 | 0 | 1 | 0 | 0 | 1448 | 1448 |
	| a.b.c.d | 8645 | e.f.g.h | 9999 | 0 | 1 | 1 | 0 | 1502 | 54 |
	| e.f.g.h | 9999 | a.b.c.d | 8645 | 0 | 1 | 0 | 0 | | 0 |
	|----------+-------------+---------+-------------+---------------+---------------+----------------+-----------------+------------------------------+----------|

view raw tshark-display-filter.sh hosted with ❤ by GitHub