Hi Lucas, 2013/3/21 Bálint Réczey <[email protected]>: > Hi Lucas, > > 2013/3/20 Lucas Nussbaum <[email protected]>: >> Package: tshark >> Version: 1.8.2-5wheezy1 >> Severity: important >> >> Hi, >> >> tshark's man page says: >> When writing packets to a file, TShark, by default, writes the file >> in libpcap format [..] >> and also says: >> -F <file format> >> Set the file format of the output capture file written using the >> -w option. The output written with the -w option is raw packet >> data, not text, so there is no -F option to request text output. >> The option -F without a value will list the available formats. > Please note that it also says: > ... > When writing packets to a file, TShark, by default, writes the > file in libpcap > format, and writes all of the packets it sees to the output file. The > -F > option can be used to specify the format in which to write the > file. This list > of available file formats is displayed by the -F flag without a value. > However, you can't specify a file format for a live capture. > > >> >> >> However: >> 1) tshark uses the pcap-ng format, not the libpcap format. >> 2) the -F switch does not work. >> >> The problem can be produced with: >> >> $ sudo tshark -i lo -w - > f ; file f >> [..] >> f: pcap-ng capture file - version 1.0 >> >> $ sudo tshark -F libpcap -i lo -w - > f ; file f >> [..] >> f: pcap-ng capture file - version 1.0 >> >> In both cases, I would expect tshark to use the libpcap format, like >> tcpdump: >> $ sudo tcpdump -i lo -w - > f ; file f >> [..] >> f: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture >> length 65535) > Please use dumpcap -P instead. From man dumpcap: > > -P Save files as pcap instead of the default pcap-ng. In situations > that > require pcap-ng, such as capturing from multiple > interfaces, this option > will be overridden. > > >> >> >> The version in experimental (1.9.1-1) is also affected. >> The version in squeeze is not affected. >> >> >> This breaks the "use tshark or dumpcap as a remote probe over SSH" use >> case described in http://wiki.wireshark.org/CaptureSetup/Pipes : >> $ wireshark -k -i <( ssh root@host tshark -i eth0 -w -) The wiki has been updated to: $ wireshark -k -i <(ssh -l root remote-host dumpcap -w - not tcp port 22)
I have fixed the man page of dumpcap upstream, since dumpcap actually accepts -w -. Cheers, Balint -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
