Wireshark · Wireshark-users: Re: [Wireshark-users] Automating TCP stream extraction

[Sake Blok <sake@xxxxxxxxxx>]

On Wed, Aug 01, 2007 at 07:49:42PM +0100, Nick Chorley wrote:
> On 01/08/07, Sake Blok <sake@xxxxxxxxxx> wrote:
> 
>  Thanks for this, Sake. I haven't had a chance to try it out yet but will do
> so soon and let you know how I get on.

Your welcome :-) 
It was a nice exercise to get the syntax right...

I did however see some error slip by in the first option:

> > for f in `cat <file-with a filter per line> | tr " " "_"`
> > do
> >    echo "processing file with filter $filter"
> >    filter=`echo $f | tr "_" " "`
> >    tshark -r <input-file> -w $filter.cap -R "$filter"
> > done

This should of course read:

for f in `cat <file-with a filter per line> | tr " " "_"`
do
   filter=`echo $f | tr "_" " "`
   echo "processing file with filter $filter"
   tshark -r <input-file> -w $f.cap -R "$filter"
done

Otherwise the echo won't show you the filters used and the -w
option would get an invalid filename...

Cheers,


Sake