From d3d802ebce9f8ab46bbf154c144a84f73adebdbc Mon Sep 17 00:00:00 2001
From: Sigma-Ohio <crt@teleco.ch>
Date: Wed, 18 Jun 2025 16:06:16 +0200
Subject: mlol yes yes configuration hacksery!

---
 executables/extract-tcp.sh | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 executables/extract-tcp.sh

(limited to 'executables')

diff --git a/executables/extract-tcp.sh b/executables/extract-tcp.sh
new file mode 100644
index 0000000..26a6f91
--- /dev/null
+++ b/executables/extract-tcp.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# Usage: ./extract-tcp.sh input.pcap output.txt
+
+if [ "$#" -ne 2 ]; then
+    echo "Usage: $0 <input.pcap> <output.txt>"
+    exit 1
+fi
+
+INPUT="$1"
+OUTPUT="$2"
+
+# Extract TCP packet information with headers and payload data
+tshark -r "$INPUT" -Y "tcp" -T fields \
+    -e data \
+    -e frame.number \
+    -e frame.time_relative \
+    -e ip.src \
+    -e ip.dst \
+    -e tcp.srcport \
+    -e tcp.dstport \
+    -e tcp.seq \
+    -e tcp.ack \
+    -e tcp.flags \
+    -e tcp.flags.syn \
+    -e tcp.flags.ack \
+    -e tcp.flags.fin \
+    -e tcp.flags.reset \
+    -e tcp.flags.push \
+    -e tcp.len \
+    -E header=y \
+    -E separator="|" > "$OUTPUT"
+
+echo "TCP packet analysis written to $OUTPUT"
+echo "Format: HexData|Frame#|Time|SrcIP|DstIP|SrcPort|DstPort|Seq|Ack|Flags|SYN|ACK|FIN|RST|PSH|DataLen"
-- 
cgit v1.2.3-70-g09d2