Pipes

Table of Contents

Quicklinks: Wireshark Docs

Piping with *shark

Piping is important to using many of these utilities. For example, it is not really possible to use rawshark without piping as it expects a FIFO or stream.

The table below shows what formats each Wireshark utility accepts and produces. Parentheses () indicate the default format when writing files.

Tool Quick Reference:

• capinfos: Display capture file information
• dumpcap: Network traffic dump tool (no dissection)
• editcap: Edit and translate capture files
• mergecap: Merge multiple capture files
• randpkt: Generate random packet capture files
• rawshark: Raw packet filter (no GUI/TUI)
• reordercap: Reorder packets by timestamp
• text2pcap: Convert hexdumps to pcap files
• tshark: Network protocol analyzer (CLI Wireshark)

1. *pcaps: All pcap types available on the system (use tshark -F to list).
2. report: Tabular or “machine-readable” data about a file.
3. (): The default output file format for a given tool.
4. raw pcap: The raw bytes of the pcap header and packets. Can be generated with cat $file | ..., read by piping to ... | tshark -r -, and saved with ... > $file.
5. hexdump: A formatted hexdump can be canonically generated by od -Ax -tx1 -v. As of Wireshark v3.0.0, tshark -r <my.pcap> -x will usually generate this as well. If hexdump is stream, send to text2pcap as <commands>... | text2pcap - <outfile>. Otherwise if it’s a file, use text2pcap <infile> <outfile>.
6. *many: Tshark is the most versatile in terms of output:

• rawpcap (-w -)
• Report (-G)
• PDU Subtrees (-V)
• Packet Representations (accessible with -T)
  • Line-based: One line per packet
    • text (default): Abbreviated packets with one per line
    • tabs: Same as text, but uses tab as delimiter
    • fields: Specify which values of the packet to show with display filters
  • JSON-based
    • json: Standard JSON format with full packet details
    • jsonraw: Raw JSON format (minimal processing)
    • ek: Elasticsearch-compatible JSON format
  • XML-based
    • pdml: Packet Details Markup Language (full packet tree)
    • psml: Packet Summary Markup Language (summary view)
  • PS-based
    • ps: Adobe PostScript file that can be converted to pdf

Using temp files instead of pipes

In bash, it’s possible to create temporary files to mimic using a pipe. In this example, editcap can only read files, so create a temp file, send filtered tshark output to it, and then read it from editcap to make further alterations.

tempfile=$(mktemp)
tshark -r dhcp.pcap -Y "dhcp.type == 1" -w $tempfile
editcap $tempfile dhcp2.pcap -a 1:"Cool story bro!"

Pipe Types

An anonymous pipe sends the output of one command to another. A named pipe (aka FIFO) is a file created by mkfifo from which data can be read and to which data can be sent, by different processes. More information about each can be found in this stackexchange post

Anonymous Pipe

In this example, tshark reads packets and sends the packet bytes to stdout. The stdout is written to the pipe which is sent to the stdin of a second tshark process.

# You may need to use sudo to capture
tshark -w - | tshark -r -

This is equivalent to tshark -r $file, only using a pipe and an extra tshark process to demonstrate send/recv on |.

Named Pipe

You can also read from a pipe like so:

mkfifo myfifo
# You may need to use sudo to capture
tshark -w myfifo & tshark -i myfifo

Confusingly, reading a pipe is through -i even though a named pipe is a file descriptor.