Login or Register to Ask a Question and Join Our Community


IP Networking

Stop tshark capture

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums IP Networking Stop tshark capture
# 1  
Old 04-29-2013
Stop tshark capture
I need to stop capturing after a specified number of Diameter messages have been received. I tried using tshark but -c <capture packet count> option is not what I need.
Any idea how I can do that? The solution has to work on Linux.
Thanks!
# 2  
Old 04-29-2013
How about using -a option to specify auto-stop condition?

Instead of Diameter messages you can estimate the capture file size value in KB and specify it as auto-stop condition.
# 3  
Old 04-29-2013
Thank you, Yoda! Autostop condition as implemented by tshark is not an option. The messages can be quite different in size so I can't rely on size. All I'm interested in is the message type (e.g. CER, CEA, CCR, RAR) and how many messages were exchanged. If I could filter out some messages (e.g CER, CEA, DWR, DWA) that would be better.


In fact what I want to achieve is to automate functional testing with Seagull. Because Seagull is only able to send Diameter requests and in my scenario I need to send SOAP requests from time to time I want to run tshark in parallel with the Seagull scenario, count Diameter messages and send a SOAP request when it's time. Any other idea on how to do that would be highly appreciated.

Thanks again!
# 4  
Old 04-29-2013
I checked the tshark manual and unfortunately I don't think there is option to stop capturing upon reaching certain number of messages.

But you can let the capture run for certain period of time and apply filter based on your preference.
# 5  
Old 04-30-2013
Unfortunately filtering offline it's not an option as well. The whole point is to model an ongoing scenario and that has to happen in real time.

As I said I'm open to any solution so I don't need to rely exclusively on tshark. I tried something like this:

tshark -i any | grep DIAMETER | awk 'BEGIN {MESSAGES=0}; /DIAMETER/ {if (MESSAGES<=6) MESSAGES++; else exit;}; END {print MESSAGES}'

but that only stopped awk and not tshark. I think I could do a kill on wireshark PID instead of exiting awk but I don't know how to get tshark PID in this setup.

Thanks!
# 6  
Old 07-08-2013
I changed the approach a little bit. I noticed I don't actually need to kill tshark in order to stop the capture.

I have the following Diameter input:

Code:
host:~/work/regression$ sudo script -q -c 'tshark -i any' /dev/null | grep DIAMETER 
  0.156393    10.0.2.15 -> 10.22.182.20 DIAMETER 236 cmd=Capabilities-ExchangeRequest(257) flags=R--- appl=Diameter Common Messages(0) h2h=0 e2e=0
  0.410201 10.22.182.20 -> 10.0.2.15    DIAMETER 332 cmd=Capabilities-ExchangeAnswer(257) flags=---- appl=Diameter Common Messages(0) h2h=0 e2e=0
  0.912780    10.0.2.15 -> 10.22.182.20 DIAMETER 408 cmd=Credit-ControlRequest(272) flags=R--- appl=3GPP Gx(16777238) h2h=1a64 e2e=fa0
  1.095632 10.22.182.20 -> 10.0.2.15    DIAMETER 276 cmd=Credit-ControlAnswer(272) flags=---- appl=3GPP Gx(16777238) h2h=1a64 e2e=fa0
  1.097361    10.0.2.15 -> 10.22.182.20 DIAMETER 312 cmd=Credit-ControlRequest(272) flags=R--- appl=3GPP Gx(16777238) h2h=1a65 e2e=fa1
  1.275714 10.22.182.20 -> 10.0.2.15    DIAMETER 204 cmd=Credit-ControlAnswer(272) flags=---- appl=3GPP Gx(16777238) h2h=1a65 e2e=fa1
  1.277086    10.0.2.15 -> 10.22.182.20 DIAMETER 312 cmd=Credit-ControlRequest(272) flags=R--- appl=3GPP Gx(16777238) h2h=1a66 e2e=fa2
  1.462886 10.22.182.20 -> 10.0.2.15    DIAMETER 204 cmd=Credit-ControlAnswer(272) flags=---- appl=3GPP Gx(16777238) h2h=1a66 e2e=fa2

After the eighth incoming Diameter message I want to run a script:

Code:
sudo script -q -c 'tshark -i any' /dev/null | grep DIAMETER | awk 'BEGIN {MESSAGES=0}; /DIAMETER/ {if (MESSAGES<8) {MESSAGES++;print MESSAGES;} else exit;}; END {print MESSAGES}'; ./do_something.sh

The following command seem to work well (meaning it launches do_something.sh) if I replace DIAMETER with HTTP in grep and DIAMETER with GET in awk but for some reason with Diameter traffic it just never stops. If I terminate it with CTRL+C I get the following output that makes me think there's something with the awk script:

Code:
host:~/work/regression$ sudo script -q -c 'tshark -i any' /dev/null | grep DIAMETER | awk 'BEGIN {MESSAGES=0}; /DIAMETER/ {if (MESSAGES<8) {MESSAGES++;print MESSAGES;} else exit;}; END {print MESSAGES}'; ./do_something.sh 
1
2
3
4
5
6
7
8
8

Any ideas?
Thanks!

---------- Post updated at 06:25 PM ---------- Previous update was at 02:10 AM ----------

I've noticed if I do the following the awk script works fine with Diameter traffic:

Code:
sudo script -q -c 'tshark -i any' /dev/null | grep DIAMETER | tee snoop.txt

cat snoop.txt | awk 'BEGIN {MESSAGES=0}; /DIAMETER/ {if (MESSAGES<8) {MESSAGES++;print MESSAGES;} else exit;}; END {print MESSAGES}'; ./do_something.sh

Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. IP Networking

Tshark/pcap and web-server response time

Hi everyone! How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can you recommend me to do that? (1 Reply)
Discussion started by: lepetal
1 Replies

2. Red Hat

How can I stop this???

I have a user ( and actually me too) getting this messages when the screen is idle, I need help on stopping this messages: 2012 Feb 20 13:30:22 servername Audit: LENGTH: "330" SESSIONID: "339384" ENTRYID: "1" STATEMENT: "1" USERID: "OPS$PT2ADM" USERHOST: "zzzzzzzzzzz" ACTION: "100" RETURNCODE:... (2 Replies)
Discussion started by: 300zxmuro
2 Replies

3. Solaris

Stop apache

Hello all. I have a Solaris 10 box and I want to install a later version of Apache than what ships with the OS. Before I install the later version, I want to completely stop the current version of Apache (the httpd service) from running or from starting at boot time. What is the best way to... (3 Replies)
Discussion started by: RobertSubnet
3 Replies

4. Solaris

stop - A

I am using solaris x86 with a pc keyboard. i am trying to get to the ok prompt i have tried ctrl-break but it is not working , alt-break will not as well. pls any thought? (4 Replies)
Discussion started by: seyiisq
4 Replies

5. UNIX for Dummies Questions & Answers

To Stop at error

Hi All, I am running parallel process as they all run the same JOBS and only thing which changes is the argument which ia passed. I am doing it as follows script.sh $1 & script.sh $2 & script.sh $3 &.. and so on. Now each process has same set of JOBS which are to be executed. Now say... (1 Reply)
Discussion started by: Prashantckc
1 Replies

6. UNIX for Advanced & Expert Users

help me stop spammer

Hello, I am hosting a site that someone is bouncing a huge amount of spam off of and I have not been able to find what file they are using to abuse my server. Short of terminating the account and telling my customer to take a hike I am hoping someone can help me find the file that is being... (1 Reply)
Discussion started by: dorpan
1 Replies

7. UNIX for Advanced & Expert Users

how to stop others users to stop viewing what i am doing ?

Hi , I have one question, suppose i am a normal user and when i use 'w' command , it shows who is logged on and what they are doing . Now i want to stop others users to know what i am doing accept the root ? can i do this ? thanks (5 Replies)
Discussion started by: mobile01
5 Replies

8. SCO

stop commands

i hit ping to ping a server, and it keeps going. how do you stop it? ctrl Z, D, C, nothing works. (2 Replies)
Discussion started by: BG_JrAdmin
2 Replies

9. Solaris

STOP A sequence

Hi, I have a sun sparc system. I don't have a sun keyboard, hence i connected a pc keyboard. I would like to know the "STOP A" equivalent command to be used on pc keyboard. Regards, Raja (4 Replies)
Discussion started by: RajaRC
4 Replies

10. Filesystems, Disks and Memory

How do I stop this???

Am having trouble trying to stop the process below ... bash# ps -eaf | grep "tape erase" root 29715 1 0 05:16:22 ttyp1 00:00:00 tape erase /dev/rStp0 root 22464 20933 1 03:40:12 ttyp6 00:00:00 grep tape eraseI've tried ... `kill -9 29715` ... but still no luck. Help... (8 Replies)
Discussion started by: Cameron
8 Replies
Login or Register to Ask a Question