in reply to Re^5: filter tcpdump packets
in thread filter tcpdump packets

Replies are listed 'Best First'.
Re^7: filter tcpdump packets
by Anonymous Monk on Sep 04, 2014 at 17:43 UTC

    So apparently you've got MPLS GRE encapsulated packets, googling that doesn't bring up a quick answer. Perhaps another monk who's worked with it before knows more about it, or you could try asking on a Wireshark help forum, since you can apply any Wireshark filters with tshark. Or you may end up having to dig into the packet manually....

Re^7: filter tcpdump packets
by Anonymous Monk on Sep 04, 2014 at 19:52 UTC

    Although in this case your post gives enough information to figure out the apparent issue, showing the code you're running generally helps too. See How do I post a question effectively?

    Also, what was meant with "the actual tshark output" is the following:

    If your code is this:

    my @cmd = ('tshark','-r',$PCAPFILE, qw# -R tcp.options.mss -T fields -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e tcp.options.mss_val #); open my $ts, '-|', @cmd or die "Error opening pipe: $!";

    Then please show the output of the following (replacing $PCAPFILE with the actual filename of course):

    ## from your command line $ tshark -r $PCAPFILE -R tcp.options.mss -T fields -e ip.src \ -e tcp.srcport -e ip.dst -e tcp.dstport -e tcp.options.mss_val

    That way we know what the input to Perl looks like.

    Although admittedly, in this case, the frame dump actually gave the most important hint as to what's going on (MPLS GRE).