Here’s a quick example of using tshark to extract email addresses from TCP streams. Let’s say some application on your server is sending emails and you want to find out who is receiving those emails.

You can find more useful tshark filters here. The capture will take place on the system’s primary NIC. You can change that by setting the nic variable manually. The other variable you may want to adjust is duration. The default value is 10 seconds. This means that tshark will spend 10 seconds gathering a list of steams and then 10 seconds capturing traffic on each stream. You may want to use different variables for these two steps. Another potential improvement is to follow steams in parallel using xargs or somesuch.

 

Leave A Reply

Please enter your comment!
Please enter your name here