Navigation X

Pentester Academy - Traffic Analysis TSHARK.

Posted by Sauron posted at


Pentester Academy - Traffic Analysis TSHARK.  90
Sauron Supreme
200
Posts
199
Threads
Supreme
#1
[Image: tshark.png] Traffic Analysis: TSHARK Unleashed
 
Most of us have used Wireshark either academically or professionally for traffic analysis. Its a great tool for microscopic analysis of what is happening in the network. However, its greatest strength is also its greatest weakness i.e. it is extremely difficult to do macroscopic analysis, create custom reports, extract only certain fields from packets for offline analysis etc. This is where Tshark comes in! Tshark is a command line tool created by the Wireshark team and shares the same powerful parsing engine as Wireshark. It is capable of doing most things we've come to love Wireshark for, but with the "from command line" advantage. This makes it ideal for batch analysis, offline processing and routine automation of traffic analysis tasks. In this course, we will explore many of these capabilities. It is assumed you have a basic working knowledge of Wireshark and traffic analysis. 
A non-exhaustive list of topics to be covered include:
  • Tshark basics
  • Automating activities with Tshark
    • Parsing
    • Filtering
      • Display, Capture and Read Filters
      • Single and Multi-Pass filters
    • Decoding
    • Field extraction
      • Locating field names
      • Exporting extractions
    • Summarization
      • Pipelining with Linux Utils e.g. sort, uniq 
    • Exporting of results
      • PDML, PSML, JSON, ELK schema
    • Pipelining with other tools
    • Python automation
      • Pyshark

Hidden Content
You must register or login to view this content.

Reply
nichacks Junior Member
5
Posts
0
Threads
Junior Member
#2
(9 days ago)Sauron Wrote: [Image: tshark.png] Traffic Analysis: TSHARK Unleashed
 
Most of us have used Wireshark either academically or professionally for traffic analysis. Its a great tool for microscopic analysis of what is happening in the network. However, its greatest strength is also its greatest weakness i.e. it is extremely difficult to do macroscopic analysis, create custom reports, extract only certain fields from packets for offline analysis etc. This is where Tshark comes in! Tshark is a command line tool created by the Wireshark team and shares the same powerful parsing engine as Wireshark. It is capable of doing most things we've come to love Wireshark for, but with the "from command line" advantage. This makes it ideal for batch analysis, offline processing and routine automation of traffic analysis tasks. In this course, we will explore many of these capabilities. It is assumed you have a basic working knowledge of Wireshark and traffic analysis. 
A non-exhaustive list of topics to be covered include:
  • Tshark basics
  • Automating activities with Tshark
    • Parsing
    • Filtering
      • Display, Capture and Read Filters
      • Single and Multi-Pass filters
    • Decoding
    • Field extraction
      • Locating field names
      • Exporting extractions
    • Summarization
      • Pipelining with Linux Utils e.g. sort, uniq 
    • Exporting of results
      • PDML, PSML, JSON, ELK schema
    • Pipelining with other tools
    • Python automation
      • Pyshark


Lol.i
Reply

Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
or
Sign in
Already have an account? Sign in here.


Users browsing this thread: 1 Guest(s)