Quicklinks: manpage
⚠️ AI-Generated Content: This section was added using Claude Code (Opus 4.6) and requires validation by the community. Please verify accuracy before relying on this information in production environments.
The -U <tap_name> flag exports Protocol Data Units (PDUs) from a capture for processing by external tools. This enables chaining tshark with protocol-specific analyzers, custom parsers, or machine learning models.
PDUs (Protocol Data Units) are the extracted payloads of specific protocols, stripped of lower-layer headers. Exporting PDUs allows you to:
# Export HTTP PDUs to a file
tshark -r capture.pcap -q -U http > http_pdus.bin
# Export SMB PDUs
tshark -r fileshare.pcap -q -U smb > smb_pdus.bin
# Export DNS PDUs
tshark -r dns.pcap -q -U dns > dns_pdus.bin
Extract HTTP request/response bodies for content analysis or malware detection:
# Export all HTTP PDUs
tshark -r web_traffic.pcap -U http -w http_only.pcap
# Then extract objects from the PDU-only capture
tshark -r http_only.pcap --export-objects http,extracted_files/
Extract SMB protocol data for file access auditing:
# Export SMB PDUs for analysis
tshark -r fileshare.pcap -U smb > smb_data.bin
# Count unique files accessed
tshark -r fileshare.pcap -U smb -T fields -e smb.file | sort -u | wc -l
Feed extracted protocols into custom parsers:
# Extract SIP calls for VoIP analysis tool
tshark -r voip.pcap -U sip | ./custom_sip_analyzer
# Extract MODBUS data for ICS analysis
tshark -r industrial.pcap -U modbus | python modbus_analyzer.py
Extract protocol data for ML model training:
# Extract TLS handshakes for fingerprinting
tshark -r traffic.pcap -U tls -T json | \
jq '.[] | select(._source.layers.tls.handshake)' | \
python train_tls_classifier.py
To see all available tap names:
tshark -G protocols | grep -i "<protocol_name>"
Common taps include:
Filter before exporting PDUs to focus on specific traffic:
# Export only HTTP POST requests
tshark -r upload.pcap -Y "http.request.method==POST" -U http > posts.bin
# Export TLS from specific IP
tshark -r capture.pcap -Y "ip.src==192.168.1.100" -U tls > client_tls.bin
# Export DNS queries to specific domain
tshark -r dns.pcap -Y 'dns.qry.name contains "example.com"' -U dns > example_dns.bin
PDUs can be exported in different formats for various use cases:
Raw protocol data, useful for binary analysis:
tshark -r capture.pcap -U http > http_raw.bin
Export as a new capture file with only the specified protocol:
tshark -r capture.pcap -U http -w http_only.pcap
Combine with text output for human-readable exports:
tshark -r capture.pcap -U http -V > http_verbose.txt
Combine PDU export with TLS decryption:
# Decrypt TLS and export application data
tshark -r encrypted.pcap \
-o "tls.keylog_file:$SSLKEYLOGFILE" \
-U tls -w decrypted_pdus.pcap
Build complex analysis pipelines:
#!/bin/bash
# Multi-stage HTTP analysis pipeline
# 1. Extract HTTP PDUs
tshark -r capture.pcap -U http -w http.pcap
# 2. Extract POST request bodies
tshark -r http.pcap -Y "http.request.method==POST" \
-T fields -e http.file_data | \
xxd -r -p > post_data.bin
# 3. Analyze POST data
file post_data.bin
strings post_data.bin | grep -i password
Extract industrial protocols for specialized analysis:
# Extract MODBUS PDUs from ICS network
tshark -r scada.pcap -U modbus > modbus_commands.bin
# Extract OPC UA for industrial monitoring
tshark -r factory.pcap -U opcua -T json | \
jq '.[] | ._source.layers.opcua' > opcua_data.json
Integrate PDU export in automated testing:
#!/bin/bash
# Test that API responses match expected schema
# Extract HTTP responses
tshark -r api_test.pcap -Y "http.response" -U http -w responses.pcap
# Extract JSON bodies
tshark -r responses.pcap -T fields -e http.file_data | \
xxd -r -p | \
while read -r json; do
echo "$json" | jq empty || {
echo "FAIL: Invalid JSON in response"
exit 1
}
done
echo "PASS: All responses contain valid JSON"
| Feature | -U (PDU Export) | --export-objects |
|---|---|---|
| Purpose | Extract raw protocol data | Extract complete files |
| Output | Binary PDU stream | Individual files |
| Use Case | Custom parsing, ML | File recovery |
| Processing | Requires external tools | Ready-to-use files |
Use -U when you need raw protocol data for custom analysis.
Use --export-objects when you need complete files (HTTP downloads, SMB transfers, etc.).
See also: Export Objects
If no PDUs are exported, check:
Protocol exists in capture:
tshark -r capture.pcap -q -z io,phs | grep -i http
Correct tap name:
tshark -G protocols | grep -i http
Display filter not too restrictive:
# Remove filter temporarily to test
tshark -r capture.pcap -U http > test.bin
ls -lh test.bin
PDU exports can be large. Optimize with:
# Filter first, then export
tshark -r huge.pcap -Y "http and tcp.port==80" -U http > http_port80.bin
# Export to compressed format
tshark -r capture.pcap -U http | gzip > http_pdus.bin.gz