0

I have a great confusion about tshark.

What is the basic unit of the messages captured by tshark? Ip, tcp, or http? I see TCP http or ssl and so on in the protocol column in wireshark.

These protocols are in different layer.

In addition, what is the tshark command to capturing the http message with tshark.

1 Answer 1

0

See the man page. To quote:

TShark is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file

Packets are usually either TCP or UDP (you can find a list of protocols here), When wireshark states that it is HTTP or SSL, then it is based on introspection of the packet (Probably based on destination port).

4
  • Tux~~. some infos given by wireshark are: Frame 210114: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface 0 Ethernet II, Src: H_a4:a0:43 (0c:d0:42:a3:40:43), Dst: IntelCor_c0:4d:01 (5c:e0:c5:c0:4d:01) Internet Protocol Version 4, Src: 10.10.40.138 (10.10.40.138), Dst: 10.97.28.50 (10.97.28.50) So, i think the socalled unit is "frame" in wireshark, not tcp or udp. May be some other protcol (like ICMP)is also Ok? Oct 9, 2015 at 10:16
  • OK, so ICMP would actually be a different protocol, but a frame is part of a packet as seen here, a packet transports an Ethernet Frame as it's payload. Wireshark is capturing and displaying information about the packets (including the frame).
    – iLoveTux
    Oct 9, 2015 at 10:34
  • why the frame number is not continuous? A tcp packet may be composed by several frame, but only one frame in wireshark. Oct 9, 2015 at 11:28
  • We've hit the point (I believe) you should be asking new questions instead of carrying on a conversation here in the comments.
    – iLoveTux
    Oct 9, 2015 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.