Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] "Follow tcp stream" in tshark

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Wed, 23 Jul 2014 15:25:09 -0400
On 07/21/14 03:42, Dario Lombardo wrote:
Hi list
I'd like to use the wireshark "follow tcp stream" functionality in
tshark. What I would like to obtain is a way to automatically (for
that I can't use wireshark) extract data stream from a bunch of
packets from a capture file.

If I run

cat FILE | nc HOST PORT

I'd like to reconstruct FILE from capture.

Is there a way to achieve this in tshark?

According to the tshark(1) man page "follow tcp stream" is available by using this option:

           -z follow,prot,mode,filter[,range]

It appears this option is present at least as far back as the 1.10.x releases.