This wiki has been migrated to and is now deprecated. Please use that site instead.


Note this is a script for people comfortable using Unix and is offered free as is.

If you are creating large captures with wireshark or tshark and are using an older slower machine it can be time consuming to get at the data you want. This script (set up to use Bash in /bin/bash, and set up to assume that TShark is installed in /sw/bin/tshark, as would be the case if it were installed as a result of installing the Wireshark Fink package on macOS) will process 3 protocols (or more if you want to modify it) and append the chosen file name with the relevant protocol. It would be easy to modify this for things such as a specific IP address etc..

The only macOS-specific aspect in the script is that it assumes that Wireshark was installed by Fink, so it looks for TShark in /sw/bin; if you haven't installed it with Fink, or if you're not using macOS, so that it's not in /sw/bin, you can change the script appropriately - or you can just say tshark rather than /sw/bin/tshark, and have it find TShark in your path if the directory containing it is in your path.

It doesn't depend on any features of Bash not implemented by other Bourne-compatible shells, so you can probably replace /bin/bash with /bin/sh, to make it work with Un*xes that don't have Bash.

osXextraction (last edited 2018-12-20 23:18:29 by GuyHarris)