blob: 26a6f9163edff16725200053179c95f26bced956 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
#!/bin/bash
# Usage: ./extract-tcp.sh input.pcap output.txt
if [ "$#" -ne 2 ]; then
echo "Usage: $0 <input.pcap> <output.txt>"
exit 1
fi
INPUT="$1"
OUTPUT="$2"
# Extract TCP packet information with headers and payload data
tshark -r "$INPUT" -Y "tcp" -T fields \
-e data \
-e frame.number \
-e frame.time_relative \
-e ip.src \
-e ip.dst \
-e tcp.srcport \
-e tcp.dstport \
-e tcp.seq \
-e tcp.ack \
-e tcp.flags \
-e tcp.flags.syn \
-e tcp.flags.ack \
-e tcp.flags.fin \
-e tcp.flags.reset \
-e tcp.flags.push \
-e tcp.len \
-E header=y \
-E separator="|" > "$OUTPUT"
echo "TCP packet analysis written to $OUTPUT"
echo "Format: HexData|Frame#|Time|SrcIP|DstIP|SrcPort|DstPort|Seq|Ack|Flags|SYN|ACK|FIN|RST|PSH|DataLen"
|
