Sample Header Ad - 728x90

GeoIP not working when processing PCAP with tshark as su

1 vote
1 answer
167 views
I am working with lots of PCAP files and trying to convert them into .tsv files for tabular analysis. So I'm using tshark in a Ubuntu 22 VirtualBox machine to dissect each packet. I have a bash command that I use within a for loop to process each PCAP file.
tshark -r "${pcapFile}" -2 \
		-T fields \
		-E separator=/t \
		-E header=y \
		-E quote=d \
		-e frame.time_epoch \
		-e _ws.col.Info \
		-e _ws.col.Protocol \
		-e ip.src \
		-e ip.dst \
		-e ip.proto \
		-e ip.version \
		-e ip.hdr_len \
		-e ip.src_host \
		-e ip.dst_host \
		-e ip.geoip.dst_city \
		-e ip.geoip.dst_country_iso \
		-e ip.geoip.dst_asnum \
		-e ip.geoip.src_city \
		-e ip.geoip.src_country_iso \
		-e ip.geoip.src_asnum \
		-e eth.src \
		-e eth.dst > "${OUTPUT_FOLDER}/${filename}.tsv"
I'm encountering some strange results. 1. When I run this command as sudo the processing runs *much* faster than when I run without sudo. 2. When I run this command as sudo, the geoip fields are empty, but when I run without sudo they are filled. I'm hoping to get the best of both worlds here, since I have many pcap files to process and would like it to move quickly, but also, I very much want the geoip information. Why can't I get the geoip fields as sudo and/or why doesn't the processing run as quickly without sudo? tshark version: 3.6.7-1~ubuntu22.04.0+wiresharkdevstable \ wireshark version: 3.6.7-1~ubuntu22.04.0+wiresharkdevstable \ System specs: 12 CPU, 24 GB RAM, Ubuntu 22.04
Asked by CopyOfA (123 rep)
Dec 22, 2022, 11:50 PM
Last activity: Dec 23, 2022, 03:59 AM