GeoIP not working when processing PCAP with tshark as su
1
vote
1
answer
167
views
I am working with lots of PCAP files and trying to convert them into .tsv files for tabular analysis. So I'm using tshark in a Ubuntu 22 VirtualBox machine to dissect each packet. I have a bash command that I use within a
for
loop to process each PCAP file.
tshark -r "${pcapFile}" -2 \
-T fields \
-E separator=/t \
-E header=y \
-E quote=d \
-e frame.time_epoch \
-e _ws.col.Info \
-e _ws.col.Protocol \
-e ip.src \
-e ip.dst \
-e ip.proto \
-e ip.version \
-e ip.hdr_len \
-e ip.src_host \
-e ip.dst_host \
-e ip.geoip.dst_city \
-e ip.geoip.dst_country_iso \
-e ip.geoip.dst_asnum \
-e ip.geoip.src_city \
-e ip.geoip.src_country_iso \
-e ip.geoip.src_asnum \
-e eth.src \
-e eth.dst > "${OUTPUT_FOLDER}/${filename}.tsv"
I'm encountering some strange results.
1. When I run this command as sudo
the processing runs *much* faster than when I run without sudo
.
2. When I run this command as sudo
, the geoip
fields are empty, but when I run without sudo
they are filled.
I'm hoping to get the best of both worlds here, since I have many pcap files to process and would like it to move quickly, but also, I very much want the geoip
information. Why can't I get the geoip
fields as sudo
and/or why doesn't the processing run as quickly without sudo
?
tshark version: 3.6.7-1~ubuntu22.04.0+wiresharkdevstable \
wireshark version: 3.6.7-1~ubuntu22.04.0+wiresharkdevstable \
System specs: 12 CPU, 24 GB RAM, Ubuntu 22.04
Asked by CopyOfA
(123 rep)
Dec 22, 2022, 11:50 PM
Last activity: Dec 23, 2022, 03:59 AM
Last activity: Dec 23, 2022, 03:59 AM