On Mon, Mar 17, 2008 at 03:47:57PM -0400, Rob MacKenzie wrote:
> Great app, quick question.
> 
> I am using tshark as part of a larger program, and I need the packet
> summaries from a pcap file.
> 
> I am getting the format I need by piping out from 
> 
> tshark -r myfile.pcap -Ttext > outfile.txt
> 
> My questions are:
> 1: is there no way to get tshark to output not to standard out but to a
> file, as the -w option just outputs the pcap file again.

At the moment, no. Is there an advantage over using the ">" redirection?

But why not save the binary data to file and use "tshark -r <file> |" in
your program to read from file? It gives much more flexibility?


> 2: The format of the -Ttext output is dertermined by the columns in
> Wireshark.  My app needs to run smoothly even if Wireshark is opened and
> configuration changed.  Where are these options stored on a windows
> machine? On a linux machine?

The preferences are saved in the file "preferences" in the directory
"c:\Documents and Settings\<user>\Application Data\Wireshark\" under
windows and <home>/.wireshark under linux.

You can override the column settings from your program by using:

tshark -o column.format:'"No.", "%m", "Time", "%t", "Source", "%s", 
"Destination", "%d", "srcport", "%uS", "dstport", "%uD", "len", "%L", 
"Protocol", "%p", "Info", "%i"' -Ttext ...

(use the format you need here!)

Another way is to use the option "-T fields -e <field> -e <field>..."
instead. That will give you control over the fields in the output. And
since they are just values seperated by a TAB (or user defined seperator), 
your program is able to parse the output more easily.


Hope this helps,
Cheers,
    Sake
_______________________________________________
Wireshark-users mailing list
Wireshark-users@wireshark.org
http://www.wireshark.org/mailman/listinfo/wireshark-users

Reply via email to