tshark 命令跟踪 tcp 流，无需 tcp 长度

Question

当我们使用命令跟踪 tcp 流时：

tshark -q -r test.pcap -z follow,tcp,ascii,0

将得到以下输出，其中 TCP 长度位于流式输出的中间。

如何消除

tcp.len

？我们是否有任何 tshark 命令只打印 TCP 流输出而不是

tcp.len

Follow: tcp,ascii
Filter: tcp.stream eq 0
Node 0: 10.10.30.50:57887
Node 1: 10.10.30.95:4902
**1448**              ---> this is tcp length
POST /pushnotification/v1.0/message HTTP/1.1
Accept: */*
Host: 10.10.30.95:4902
Connection: Close
Content-Type: application/json
Authorization: Basic QWxhZGRpbjpraHVsamFzaW1zaW0=
Content-Length: 1277

{"push-message":{"serviceName":"Sync App","TTL":"600","recipients":[{"uri":"sip:[email protected]"}],"channel":"","pns-type":"RCSPage","pns-subtype":"Chat","nmsEventList":{"nmsEvent":[{"changedObject":{"parentFolder":"https:///oemclient/nms/v1/ums/tel%3a%2b1234567890/folders/97d38f52-bed0-4046-8784-bb110e3b0ea3","flags":{"flag":["\\RECENT"]},"resourceURL":"https://resourceurl","correlationId":"75114622-099d-4503-8166-e84bd1b620dc","message":{"id":"1","store":"RCSMessageStore/Chat","objectURL":"https://data1","direction":"In","message-time":"2016-05-19T08:46:49-08:00","status":"RECENT","sender":"sip:1234","recipients":[{"uri":"sip:2345"}],"imdn-message-id":"75114622-099d-4503-8166-e84bd1b620dc","content":[{"rcs-data":{"sip-call-id":"005056884776-4d72-eb161700-1e2-571fa736-a0e46","feature-tag":"urn:urn-7:3gpp-service.ims.icsi.oma.cpm.msg.group","p-asserted-service":"urn:urn-7:3gpp-service.ims.icsi.oma.cpm.msg.group","contribution-id":"e0a1029e-a48b-4ca6-b185-299dada439be","conversation-id":"2dbc584e-
**38**   ---> this is tcp length 
fc46-4a37-9a56-c2b93246d788"}}]}}}]}}}
    **17**
HTTP/1.0 200 OK

    **35**
Server: BaseHTTP/0.3 Python/2.6.6

    **37**
Date: Mon, 12 Feb 2018 19:14:17 GMT

    **2**

    **9**
Thread-1

Answer 1

最简单的方法是像

tshark -q -r test.pcap -z follow,tcp,hex,0

一样运行它，然后使用其他实用程序（如

awk

）抑制输出中的十六进制部分。输出模式hex不会输出这个长度。

这是 Tshark 文档的摘录：

由于 ascii、ebcdic 或 utf-8 模式下的输出可能包含换行符，因此输出的每个部分前面都有其长度（以字节为单位）加上换行符。 （请注意，对于 utf-8，这不是 UTF-8 字符，并且由于替换字符替换了无效序列，可能与传输的长度不同。）