Questions[tshark](server)

I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.

An example of the desired output would be as follows:

% head Data3.txt 
0.000000,0000000041000000005ec812ac00047dce00000000
0.000194,0000000042000000005ec812ac00047db500000000
0.000227,0000000041000000005ec812ac00047dce00000000
0.000619,0000000042000000005ec812ac00047db500000000
0.000663,0000000041000000005ec812ac00047dce00000000
0.000854,0000000042000000005ec812ac00047db500000000
0.000883,0000000041000000005ec812ac00047dce00000000

I do not need this exact format, just a format that can later be transformed into this data (in this case they are 21 bytes length UDP packets).

I am struggling to achieve this with tcpdump without success, so I have found that tshark can do the job:

  tshark -r May31Jun5.pcap -t r -T fields -e frame.time -e data

That command gives the delta time and payload as required (see below excerpt).

Jun  1, 2020 00:02:27.567001000 CEST    0000000041000000005ed4297300049fe300000000
Jun  1, 2020 00:02:27.567014000 CEST    0000000042000000005ed4297300049fb100000000
Jun  1, 2020 00:02:27.567028000 CEST    0000000041000000005ed4297300049fe300000000
Jun  1, 2020 00:02:27.567042000 CEST    0000000042000000005ed4297300049fb100000000
Jun  1, 2020 00:02:27.567056000 CEST    0000000041000000005ed4297300049fe300000000
Jun  1, 2020 00:02:27.567066000 CEST    0000000042000000005ed4297300049fb100000000
Jun  1, 2020 00:02:27.567106000 CEST    0000000054000000005ed4297300049fb100000001
Jun  1, 2020 00:02:27.567124000 CEST    0000000041000000005ed4297300049fe300000000
Jun  1, 2020 00:02:27.567137000 CEST    0000000042000000005ed4297300049fb100000000
Jun  1, 2020 00:02:27.567152000 CEST    0000000041000000005ed4297300049fe300000000
Jun  1, 2020 00:02:28.095487000 CEST    0000000041000000005ed4297300049fe300000000

However I would like to have just seconds with decimals, so instead of:

Jun  1, 2020 00:02:28.095487000

It would be:

148.095487000

How can I achieve that? I guess it is possible because the GUI version of Wireshark display that value.

I'm trying to capture raw http requests for re-playing it later using JMeter and Raw Data Source plugin. I've tried tshark/tcpdump but it captures the whole TCP data which I dont need, moreover, it cannot save such format to the file, I dont want to use any web server logging plugin to do it, since when you get access to the request data it is usually already parsed by the server, so you have to recreate the raw request which defeats the idea of "rawness". To put it simple, I want to capture HTTP request as they on the wire, before it got parsed or whatever and I want to save it to a file. is it possible? how?

Here is the scenario.

I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables.

Is there a way to do it with a script? Right now I am doing it manually by using

tshark -i eth1 -f "net 1.2.3.4 and src port 2000"

I'm not sure how to pipe this into a script and automatically find the destination ip.

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP subscription.

I am currently getting around this by having a separate application hold the groups open I wish to record, but I am trying to set up a system to start/stop recording data dynamically and this extra complexity is painful.

Is there a way to force Wireshark to send out IGMP Subscriptions for multicast groups it is recording?

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port.

The equivalent tcpdump command would be:

tcpdump -s 0 -i any -w mycapture.trc port 80 host google.com

which outputs :

46 packets captured
131 packets received by filter
0 packets dropped by kernel

I'd like something similar that outputs:

54 bytes out, 176 bytes in

I'd like it to work on RHEL and be free/open-source. It would be good if there was an existing tool which I was just missing too!