TShark: Difference between revisions
From Lolly's Wiki
Jump to navigationJump to search
No edit summary |
No edit summary |
||
| Line 13: | Line 13: | ||
</source> | </source> | ||
The little awk magic selects only pakets which are from our ethernet address on interface ''IFACE''. | The little awk magic selects only pakets which are from our ethernet address on interface ''IFACE''. | ||
==Duplicate ACKs== | |||
<source lang=bash> | |||
# tshark -i eth1 -Y tcp.analysis.duplicate_ack | |||
</source> | |||
==Finding TCP problems== | |||
<source lang=bash> | |||
# tshark -i eth1 -Y 'expert.message == "Retransmission (suspected)" || expert.message == "Duplicate ACK (#1)" || expert.message == "Out-Of-Order segment"' | |||
</source> | |||
Revision as of 08:10, 30 June 2016
Kategorie:MySQL Kategorie:Security
TShark
TShark is the terminal based wireshark.
The ultimate tool to sniff network traffic when you have no X. It analyzes the traffic as wireshark does. Great tool!
MySQL traffic
To look on an application server for MySQL traffic you can use this line:
# IFACE=eth0 ; tshark -i ${IFACE} -d tcp.port==3306,mysql -R "eth.addr eq $(ip link show ${IFACE} | awk '$1 ~ /link\/ether/{print $2}')" -T fields -e mysql.query 'port 3306'
The little awk magic selects only pakets which are from our ethernet address on interface IFACE.
Duplicate ACKs
# tshark -i eth1 -Y tcp.analysis.duplicate_ack
Finding TCP problems
# tshark -i eth1 -Y 'expert.message == "Retransmission (suspected)" || expert.message == "Duplicate ACK (#1)" || expert.message == "Out-Of-Order segment"'
