On 3 sep 2010, at 06:26, James Hozier wrote:
>>> tshark -i en1 -tad -lnx -d tcp.port==7001,irc -R
>> 'irc'
>>>
>>> When I start to see the packets on my screen, they are
>> from port 6667,
>>> not from port 7001. Anything from port 7001 I do not
>> see, but it listens
>>> to port 6667 for some reason? Why does it do this?
>>
>> -d ... means decode any traffic on tcp port 7001 as
>> irc;
>> (it does *not* mean
>> 'listen on this port)
>> -R .. means filter on irc packets.
>>
>> If you want to just see port 7001 traffic you should use
>> -R 'tcp.port==7001'
>
> Okay so then I have this:
> tshark -i en1 -tad -lnx -R 'tcp.port==7001'
>
> How do I specify IRC only? And not other packets?
Combine the two:
tshark -i en1 -tad -lnx -d tcp.port==7001,irc -R "tcp.port==7001 && irc"
This command will interpret traffic on poort 7001 as IRC (-d tcp.port==7001,irc) and then use a display filter to only show traffic that was on port 7001 (-R "tcp.port==7001...), but only those packets that are dissected as IRC (...&& irc").
Hope this helps,
Cheers,
Sake
