Nfdump -O packets -R cases/ -A srcip,dstip ‘proto tcp and src ip 8.8.8.8 and flags S and not flags AFRPU’ Show only session with SYN flag, order by packets, aggregate scr & dst ip’s.Nfdump -O bytes -o extended -R cases/ ‘ip 8.8.8.8’ -A proto

Order by amount of bytes, Aggregate on proto type.

Http.request and http.host contains “google” Obtain base64 code from follow stream in wireshark and save to fileĬat base64-from-url.txt | uridecode.py > native-base64.txtīase64 -di native-base64.txt > decode-base64.bin Sudo tcpdump -n -i eth0 -s 0 -w /cases/scan.pcap Sudo tcpdump -n -i eth0 -s 0 “arp and not ether dst ff:ff:ff:ff:ff:ff” Tshark -n -r /cases/*.pcap -T fields -E separator=/t -e frame.number -e frame.time -e http.referer -e okie -Y ‘ contains “dropbox”‘ Tshark -n -r /cases/*.pcap -Y ‘tcp.stream=27757’ -T fields -e tcp.segment_data > /cases/extract.txt Tshark -n -x -r /cases/*.pcap -Y ‘frame.number=27757’ -T fields -e tcp.stream

Tshark -n -r /cases/*.pcap -Y ‘http.host contains “dropbox.xom” and = “POST”‘ Tshark -n -r /cases/*.pcap -Y ‘http.host contains “google” and http.request’ Or, alternatively, tshark -w stuff.pcap will write the raw packets into that file, which you can then copy to another machine and open within the wireshark gui, if you want to do more in-depth investigation.Tshark -r /cases/*.pcap -Y ftp -T fields -e ip.src -e ip.dst | sort | uniq -c | sort –nr

|tee packetlog so it goes both to the screen and to the file. Sure, tshark (text shark) is the same program, but with a noninteractive command line interface.

Tshark commands