Wireshark-users: Re: [Wireshark-users] tshark filter
From: "j.snelders" <[email protected]>
Date: Fri, 15 Oct 2010 05:44:22 +0200
Hi David,

Use:
$ tshark -r ftp.pcap -R "(ftp.response.code == 230 || ftp.request.command
== "PASS") || (ftp.request.command == "USER")"

Best regards
Joke

On Thu, 14 Oct 2010 19:04:38 -0400 David Milbourne wrote:
>So I did:
>
>tshark -r <capturefile> 'ftp.response.code == 230'
>
>And it shows me all the successful logins.  Is there a way to combine that
>with:
>
>'(ftp.request.command == "PASS" or ftp.request.command == "USER")'
>
>in order to show all the valid usernames and passwords that were used to
>successfully log in?
>
>Thanks in advance,
>DM
>
>On Wed, Oct 13, 2010 at 5:53 PM, David Milbourne <[email protected]> wrote:
>
>> Marco,
>>
>> That works - thank you!
>>
>> DM
>>
>>
>> On Wed, Oct 13, 2010 at 3:58 AM, Marco Simone Zuppone <[email protected]> wrote:
>>
>>> Hello,
>>>
>>> you can try with: ftp.response.code == 230
>>>
>>> Regards.
>>> Marco S. Zuppone
>>>
>>> On Tue, Oct 12, 2010 at 10:56 PM, David Milbourne <[email protected]>wrote:
>>>
>>>> I have a capture file that I'd like to go through and list all of the
>>>> successful ftp logins.  How can I do that with tshark?
>>>>
>>>> Thanks,
>>>> DM