# How to write a dump file without package bytes (only lines of text-package list), and that at the same time it was possible to read this file in real time? edit

I can not find how to do it. Need something similar Linux command "tcpdump -i any -s 0 -l -t -q > /tmp/log". This is necessary in order for Windows to be able to view such a file in the cygwin console while the dump is being written in real time. With tshark I could not understand to understand how to do it.

edit retag close merge delete

Sort by » oldest newest most voted

On Windows you can use tshark (part of the Wireshark suite) to do mostly the same thing.

Some caveats;

• Windows doesn't support the -i any option to select all interfaces, instead you'll have to explicitly add the interfaces required with multiple -i entries. Use tshark -D to list the interfaces.
• The -I option may or may not put WiFi interfaces into monitor mode. This is an issue with Windows WiFI NIC drivers. You may have to omit this option.
• The -t option of tcpdump to suppress the timestamp isn't supported directly by tshark, so should be omitted.
• The -q option of tcpdump to reduce the output isn't directly supported so should be omitted.

This gives a command line similar to:

path\to\tshark.exe -i x -i y -s 0 > C:\temp\log

where x and y are the interfaces you wish to capture on.

You may also use -T fields -e xxx -e yyy ... to limit the output to fields as specified by multiple -e options.

more

Thanks! Bat how to disable the buffer? The file is written in blocks, not immediately. And I need each new line to be added at once. The buffer can accumulate for a long time, if you limit the rules of traffic capture.

( 2019-11-08 12:16:13 +0000 )edit

From the aforementioned man page:

-l

Flush the standard output after the information for each packet is printed. (This is not, strictly speaking, line-buffered if -V was specified; however, it is the same as line-buffered if -V wasn't specified, as only one line is printed for each packet, and, as -l is normally used when piping a live capture to a program or script, so that output for a packet shows up as soon as the packet is seen and dissected, it should work just as well as true line-buffering. We do this as a workaround for a deficiency in the Microsoft Visual C++ C library.)

This may be useful when piping the output of TShark to another program, as it means that the program to which the output is piped will see the dissected data for a packet as soon as TShark sees the packet and generates that ...

(more)
( 2019-11-08 13:14:29 +0000 )edit

-I dont work.

$./tshark.exe -i 4 -s 0 -B 1 -I -T fields -e frame.number -e ip.addr -e udp -e _ws.col.Info > /cygdrive/c/Users/Hifexar/Desktop/tshark Capturing on 'Подключение по локальной сети' tshark: The capture session could not be initiated on interface '\Device\NPF_{2692855C-A25F-428C-BB4C-C6B124481B73}' (Generic error). Please check to make sure you have sufficient permissions, and that you have the proper interface or pipe specified. 0 packets captured [email protected] /cygdrive/c/Program Files/Wireshark$

Without -I works, but with a buffer.

( 2019-11-08 13:27:12 +0000 )edit

O, thanks! "lower case l" -l works.

( 2019-11-08 13:30:02 +0000 )edit

"On Windows you can use tcpdump" - should this be tshark?

( 2019-11-08 13:34:21 +0000 )edit
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 1, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0, "katex": 0, "math-container": 0, "wp-katex-eq": 0, "align": 0, "equation": 0, "x-ck12": 0, "texerror": 0, "math_score": 0.15002746880054474, "perplexity": 3429.8185091604146}, "config": {"markdown_headings": true, "markdown_code": false, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 10, "end_threshold": 15, "enable": true}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "plain"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "warc_path": "s3://commoncrawl/crawl-data/CC-MAIN-2020-24/segments/1590347439928.61/warc/CC-MAIN-20200604094848-20200604124848-00157.warc.gz"}