Wireshark-users: Re: [Wireshark-users] tshark filter
From: David Milbourne <[email protected]>
Date: Thu, 14 Oct 2010 19:04:38 -0400
So I did:

tshark -r <capturefile> 'ftp.response.code == 230'

And it shows me all the successful logins.  Is there a way to combine that with:

'(ftp.request.command == "PASS" or ftp.request.command == "USER")'

in order to show all the valid usernames and passwords that were used to successfully log in?

Thanks in advance,
DM

On Wed, Oct 13, 2010 at 5:53 PM, David Milbourne <[email protected]> wrote:
Marco,

That works - thank you!

DM


On Wed, Oct 13, 2010 at 3:58 AM, Marco Simone Zuppone <[email protected]> wrote:
Hello,
 
you can try with: ftp.response.code == 230
 
Regards.
Marco S. Zuppone

On Tue, Oct 12, 2010 at 10:56 PM, David Milbourne <[email protected]> wrote:
I have a capture file that I'd like to go through and list all of the successful ftp logins.  How can I do that with tshark?

Thanks,
DM

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:[email protected]?subject=unsubscribe


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:[email protected]?subject=unsubscribe