How to Export Tshark Objects Without Stopping It

Question

Requirement: I need to obtain files/objets of any kind that are being downloaded via my wifi interface.

I am running tshhark to listen to my wifi interface and export HTTP objects to a given directory using the following command.

 tshark -i wlp4s0 --export-object "http,/tmp/tshark-objects/"

It successfully intercepts the objects but does not write them automatically in the specified path unless i manually stop tshark using "Ctrl+C".

Question: How do I export objects of any kind that are downloaded via different protocols using the same command/script.

Constraint:

I want tshark to run continuously and exporting the objects as soon as they are transmitted over the network. PS Using tshark is not mandatory for me. I can switch to some other tool if that fulfills this requirement.

Accepted Answer

Must Read

Use 2 tshark processes

The answer is that you should write and export with different tshark processes. This can be done with file rotation by creating a new file on a condition. There are a couple different options you can use:

 -b <ringbuffer opt.> ..., --ring-buffer <ringbuffer opt.>
                           duration:NUM - switch to next file after NUM secs
                           filesize:NUM - switch to next file after NUM KB
                              files:NUM - ringbuffer: replace after NUM files
                            packets:NUM - switch to next file after NUM packets
                           interval:NUM - switch to next file when the time is
                                          an exact multiple of NUM secs

For example, to rotate every minute, use

$ tshark -b duration:60 -w output.pcap

To export objects from new files as they appear, you need to watch the filesystem for new files. You can use inotify on linux, fswatch on osx, or similar utilities on other platforms.

How to Export Tshark Objects Without Stopping It

2 Answers

Must Read

Use 2 tshark processes

Elena Rostova