How to get the request sent by my computer using tshark

Question

I ran tshark -V > file.log in my terminal and then in a separate terminal I ran curl 'www.google.com'. I then returned to the first terminal, shut off tshark and then looked at file.log. In it there are a number of 'frames'. For example, here is one of them:

 Frame 42: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface en0, id 0
    Interface id: 0 (en0)
        Interface name: en0
        Interface description: Wi-Fi
    Encapsulation type: Ethernet (1)
    Arrival Time: Nov  3, 2020 17:28:15.022217000 PST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1604453295.022217000 seconds
    [Time delta from previous captured frame: 0.000244000 seconds]
    [Time delta from previous displayed frame: 0.000244000 seconds]
    [Time since reference or first frame: 12.164253000 seconds]
    Frame Number: 42
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp]
Ethernet II, Src: *****, Dst: *****
    Destination: *****
        Address: *****
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: Apple_81:82:2f (ac:bc:32:81:82:2f)
        Address: Apple_81:82:2f (ac:bc:32:81:82:2f)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: *****, Dst: *****
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 52
    Identification: 0x0000 (0)
    Flags: 0x40, Don't fragment
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment Offset: 0
    Time to Live: 64
    Protocol: TCP (6)
    Header Checksum: 0xabe8 [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 134.87.182.156
    Destination Address: 172.217.165.14
Transmission Control Protocol, Src Port: 55888, Dst Port: 80, Seq: 76, Ack: 530, Len: 0
    Source Port: 55888
    Destination Port: 80
    [Stream index: 3]
    [TCP Segment Len: 0]
    Sequence Number: 76    (relative sequence number)
    Sequence Number (raw): 2379446728
    [Next Sequence Number: 76    (relative sequence number)]
    Acknowledgment Number: 530    (relative ack number)
    Acknowledgment number (raw): 278173922
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x010 (ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 0... = Push: Not set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ·······A····]
    Window: 2048
    [Calculated window size: 131072]
    [Window size scaling factor: 64]
    Checksum: 0xc5b6 [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - No-Operation (NOP)
            Kind: No-Operation (1)
        TCP Option - Timestamps: TSval 190086814, TSecr 4203481592
            Kind: Time Stamp Option (8)
            Length: 10
            Timestamp value: 190086814
            Timestamp echo reply: 4203481592
    [SEQ/ACK analysis]
        [This is an ACK to the segment in frame: 41]
        [The RTT to ACK the segment was: 0.000244000 seconds]
        [iRTT: 0.064637000 seconds]
    [Timestamps]
        [Time since first frame in this TCP stream: 0.219685000 seconds]
        [Time since previous frame in this TCP stream: 0.000244000 seconds]

I think each frame corresponds to a single request sent or received by my computer. I want to know how to reconstruct the exact request sent by my computer to googles server. Additionally, I want to know how to capture whatever was returned by the server.

Answer 1

During the packet capture you can use the -f (capture filter) option to extract only the packets linked to www.google.com

tshark -a duration:10 -T text -V -f "host www.google.com" > capture.txt 

I set the -a (autostop) capture option to 10 seconds, because I was only doing the curl 'www.google.com' once.

The command above will capture all TCP and UDP related to the curl request.

If you want to reassemble the connection after a capture you need to create a pcap file during the capture:

# this is capturing all traffic 
tshark -a duration:10 -w capture.pcap

You can query this pcap file in multiple ways:

tshark -r capture.pcap -Y http.request -T fields -e http.host -e http.user_agent
# output 
www.google.com  curl/7.64.1'

tshark -r capture.pcap -Y "(http.host == www.google.com)"
44   1.631029 192.168.86.35 → 64.233.177.105 HTTP 144 GET / HTTP/1.1  

tshark -r capture.pcap -Y "dns.qry.name == www.google.com" 
#output 
36   1.546800 192.168.86.35 → 192.168.86.1 DNS 74 Standard query 0xe159 A www.google.com
39   1.587633 192.168.86.1 → 192.168.86.35 DNS 170 Standard query response 0xe159 A www.google.com A 64.233.177.105 A 64.233.177.104 A 64.233.177.103 A 64.233.177.99 A 64.233.177.147 A 64.233.177.106

# get the frame details for TCP packets associated with google
tshark -r capture.pcap  -T fields -e tcp.stream -Y "tcp contains google"
#output frame number(s)

# get the frame details for UDP packets associated with google
tshark -r capture.pcap  -T fields -e udp.stream -Y "udp contains google"

# follow the TCP frame 
# this should return the curl request for www.google.com
tshark -r capture.pcap -q -z follow,tcp,ascii,frame_number 

# follow the UDP frame
tshark -r capture.pcap -q -z follow,udp,ascii,frame_number 

Hopefully, this answer helps solve your question.