Wireshark,Tshark

Specific domains Data handling
1

I have installed wireshark and there is a terminal Tshark exe, there.
How do i manage, when the powershell opens the t-shark terminal, that i received the datas by echo or piping into the matrix?
“cd C:\Programme\Wireshark;”

[tshark,bOK] = powershell(path(2)+“start tshark.exe {-i Ethernet -F pcapng -W n}”)

2

I modified my code but still have problems with asciimat.

Scilab-Wireshark.sci (818 Bytes)

3

Hello,

Why do you open a csv file in binary mode ? You can use csvRead instead.

S.

4

i tried it with uiimport () but it does not want to open it. because it is a csv with UTF-8 or something else it has minus numbers uint8. Its a little wired what Tshark gives me out, when i look with Editor.

Thanks :slight_smile:

6

You did not read the tshark help:

Output:
  -w <outfile|->           write packets to a pcapng-format file named "outfile"
                           (or '-' for stdout). If the output filename has the
                           .gz extension, it will be compressed to a gzip archive

if you want a csv just redirect tshark’s output with “>” (“start” options have also to be tweaked a little bit, as well as tshark options, e.g. “duration”):

outfile = TMPDIR+"\tshark.csv";
path = """C:\Program Files\Wireshark\""";
host("start /b /d "+path+" tshark.exe -i Ethernet -T fields -e frame.number -e ip.src -e ip.dst -E separator=, -E quote=d -E header=y -a duration:2> " + outfile);

--> readtable(outfile)

 ans = [80x3 table]

   frame.number      ip.src           ip.dst     
   ____________   _____________   _______________
                                                 
   1              192.168.1.101   192.168.1.147  
   2              192.168.1.147   239.255.255.250
   3              192.168.1.147   192.168.1.101  
       ...             ...              ...      
   78             192.168.1.147   192.168.1.101  
   79             192.168.1.101   192.168.1.147  
   80             192.168.1.147   192.168.1.101
7

Thank you, id did read it and itried this with piping, but it hasent work, maybe i had something wrong.

But here is the file that gives me tshark anyway.

Again, thank you for your help, even this late.

M.f.g. Pascal

tshark.csv (4.6 KB)

8

Did you really copy/paste the lines I gave above ?

9

now yes and it works, thanks, the csv that i gave you was from the request above.

But now it works as it should be. (misunderstanding)

Thanks. :slight_smile:

10

It is definitely not a csv file…

S.

11

Yes, i presume its pcapng file, but at that time i found nothing better, but now with your solution its better.

M.f.G. Pascal

12

yes, seems that giving more flags to tshark.exe allows to get even more stuf (hence more columns in the csv file).

13

Yes and it is also otherwise encoded