TShark: CLI Wireshark Features

tshark -r write-demo.pcap -z endpoints,ip -q

In which packet lengths row is our packet listed?

tshark -r write-demo.pcap -z plen,tree -q

What is the summary of the expert info?

tshark -r write-demo.pcap -z expert -q

tshark -r demo.pcapng -z conv,ip -q  

tshark -r demo.pcapng -z ip_hosts,tree -q

What is the "destination address percentage" of the previous IP address?

tshark -r demo.pcapng -z ip_srcdst,tree -q

What is the average "Qname Len" value?

DNS Qname Len refers to the "query name length" in DNS configuration, which specifies the maximum length of the query name used to identify a domain. This setting is used to limit the number of characters in the query name, which can help prevent DNS lookup attacks.

How DNS Qname Len Works:

1. Query Name
   
   : When you visit a website, DNS looks up a query name associated with the domain. The query name is the part of the URL before the domain, such as http://example.com/.
2. Length Limit
   
   : DNS Qname Len limits the length of this query name. If the query name exceeds the specified length, DNS servers may respond with a timeout or block the request.

Common Uses:

• DNS Name servers use DNS Qname Len to ensure that domain names are queried with a reasonable length.
• It is often set to 20 characters by default but can be adjusted based on needs.

Example DNS Configuration:

DNS
复制代码
example.com:    query-name: 20

In this example, query-name: 20 sets the maximum query name length to 20 characters.

tshark -r demo.pcapng -z dns,tree -q

tshark -r demo.pcapng -z follow,udp,ascii,0 -q

tshark -r demo.pcapng -z follow,http,ascii,1 -q

tshark -r credentials.pcap -z credentials -q|grep FTP |wc -l

tshark -r demo.pcapng -Y 'http.server contains "CAFE"'

tshark -r demo.pcapng -Y 'http.request.method matches "(GET|POST)"' -T fields -e frame.time

tshark -r hostnames.pcapng -T fields -e dhcp.option.hostname | awk NF | sort -r | uniq -c | sort -r | wc -l

What is the total appearance count of the "prus-pc" hostname?

tshark -r dns-queries.pcap -T fields -e dns.qry.name | awk NF | sort -r | uniq -c | sort -r

tshark -r user-agents.pcap -T fields -e http.user_agent | awk NF | sort -r | uniq -c | sort -r

tshark -r user-agents.pcap -Y 'http.user_agent contains "Nmap"' -T fields -e http.host 

原文始发于微信公众号（Definite R3dBlue）：TShark: CLI Wireshark Features