sharkd 请求语法 ​

{"req":"analyse"}{"frames":53882,"protocols":["frame","eth","ethertype","ip","tcp","http","tds","data-text-lines","data","arp","udp","dns","dcerpc","cldap","spnego","spnego-krb5","ldap","gss-api","ipv6","dhcpv6","kerberos","nbdgm","smb","browser","nbss","smb2","urlencoded-form"],"first":1476281874.317326069,"last":1476283715.849661112}

{"req":"bye"}C:\Development\wsbuild64\run\Debug\sharkd.exe (process 10396) exited with code 0.To automatically close the console when debugging stops, enable Tools->Options->Debugging->Automatically close the console when debugging stops.Press any key to close this window . . .

{"req":"check", "field":"tcp.srcport"}{"err":0,"field":"ok"}{"req":"check", "field":"transum.art"}{"err":0,"field":"notfound"}{"req":"check", "filter":"tcp.dstport==80"}{"err":0,"filter":"ok"}{"req":"check", "filter":"tcp.bad_field==80"}{"err":0,"filter":"Neither \"tcp.bad_field\" nor \"80\" are field or protocol names."}{"req":"check", "filter":"tcp.dstport==abc"}{"err":0,"filter":"\"abc\" is not a valid number."}{"req":"check", "filter":"tcp.dstport==80 &| tcp.srcport==45678"}{"err":0,"filter":"Syntax error near \"tcp.srcport\"."}{"req":"check", "filter":"tcp.dstport==80 && tcp.srcport==89000"}{"err":0,"filter":"\"89000\" too big for this field, maximum 65535."}

{"req":"complete", "field":"http.request.method"}{"err":0,"field":[{"f":"http.request.method","t":26,"n":"Request Method"}]}{"req":"complete", "field":"http.request"}{"err":0,"field":[{"f":"http.request","t":2,"n":"Request"},{"f":"http.request_number","t":7,"n":"Request number"},{"f":"http.request.line","t":26,"n":"Request line"},{"f":"http.request.method","t":26,"n":"Request Method"},{"f":"http.request.uri","t":26,"n":"Request URI"},{"f":"http.request.uri.path","t":26,"n":"Request URI Path"},{"f":"http.request.uri.query","t":26,"n":"Request URI Query"},{"f":"http.request.uri.query.parameter","t":26,"n":"Request URI Query Parameter"},{"f":"http.request.version","t":26,"n":"Request Version"},{"f":"http.request.full_uri","t":26,"n":"Full request URI"},{"f":"http.request_in","t":35,"n":"Request in frame"}]}{"req":"complete", "field":"http.bad_ref"}{"err":0,"field":[]}{"req":"complete", "pref":"tcp"}{"err":0,"pref":[{"f":"tcp","d":"TCP"},{"f":"tcpencap","d":"TCPENCAP"},{"f":"tcpros","d":"TCPROS"}]}

{"jsonrpc":"2.0","id":3,"method":"tap", "params":{"tap0":"eo:http"}}

{"jsonrpc":"2.0","id":3,"method":"download", "params":{"token":"eo:http_0"}}

{"req":"download","token":"eo:http_0"}

{"req":"download","token":"eo:http_1"}

{"req":"download","token":"rtp:200.57.7.204_8000_200.57.7.196_40376_0xd2bd4e3e"}

RSA Session-ID:xxxx Master-Key:yyyy\n

CLIENT_RANDOM zzzz yyyy\n

{"req":"download","token":"eo:http_0"}{"file":"About","mime":"text/html","data":"PCFET0NUWV ... ib2R5Pg0KPC9odG1sPg0K"}{"req":"download","token":"rtp:200.57.7.204_8000_200.57.7.196_40376_0xd2bd4e3e"}{"file":"rtp:200.57.7.204_8000_200.57.7.196_40376_0xd2bd4e3e","mime":"audio/x-wav","data":"UklGRv////9XQVZF ... AQQAsj/eABwA5AC6P4Y/8gB8AJQAzAC"}

{"req":"dumpconf","pref":"tcp.desegment_tcp_streams"}{"prefs":{"tcp.desegment_tcp_streams":{"b":1}}}{"req":"dumpconf"}{"prefs": ..."ber.decode_primitive":{"b":0}, ..."bgp.asn_len":{"e":[{"v":0,"s":1,"d":"Auto-detect"},{"v":2,"d":"2 octet"},{"v":4,"d":"4 octet"}]} ..."bjnp.udp.port":{"r": "8611-8614"}, ..."couchbase.tls.port":{"u": 11207}, ..."couchbase.tcp.port":{"r": "11210"}, ...

{"req":"follow","follow":"HTTP","filter":"tcp.stream==0"}{"err":0,"shost":"192.168.3.78","sport":"80","sbytes":110,"chost":"192.168.3.85","cport":"46815","cbytes":5339,"payloads":[{"n":4,"d":"R0VUIC9NeUFwcC9Ib21lL0Fib3V ... 5NQ0KDQo=","s":1},{"n":9,"d":"PCFET0 ... KPC9odG1sPg0K","s":1}]}{"req":"follow","follow":"TCP","filter":"tcp.stream==1"}{"err":0,"shost":"192.168.3.79","sport":"1433","sbytes":163222,"chost":"192.168.3.78","cport":"50442","cbytes":66745,"payloads":[{"n":5,"d":"AQkBBAAAA ... hAHQAZQA="},{"n":6,"d":"BAEBCQBH ... AYAAAA=","s":1},{"n":22741,"d":"BgAAABoAQwByAGUAYQB0AGkAdgBlACAAQQByAHQAcwAAAAAAALb7XKyOAAAAAAAABAIAAAAIAAAAAAAAAA+q/xEAwQAKAAAAAAAAAHkAAAAA/gAA4AAAAAAAAAAAAA==","s":1}]}{"req":"follow","follow":"TCP","filter":"tcp.stream==10000"}{"err":0,"shost":"NONE","sport":"0","sbytes":0,"chost":"NONE","cport":"0","cbytes":0}

{"req":"frame", "frame":4}{"err":0,"fol":[["HTTP","tcp.stream eq 0"],["TCP","tcp.stream eq 0"]]}{"req":"frame", "frame":4, "proto":true}{"err":0,"tree":[{"l":"Frame 4: 176 bytes on wire (1408 bits), 176 bytes captured (1408 bits) on interface \\Device\\NPF_{304D305E-652F-47CD-B730-94986169FE76}, id 0","h":[0,176],"t":"proto","f":"frame","e":10538,"n":[{"l":"Interface id: 0 (\\Device\\NPF_{304D305E-652F-47CD-B730-94986169FE76})","f":"frame.inter ... rue},{"l":"Req Spread: 0.000000000 seconds","f":"transum.reqspread == 0.000000000","g":true},{"l":"Rsp Spread: 0.000164000 seconds","f":"transum.rspspread == 0.000164000","g":true},{"l":"Trace clip filter: tcp.stream==0 && frame.number>=4 && frame.number<=9 && tcp.len>0","f":"transum.clip_filter == \"tcp.stream==0 && frame.number>=4 && frame.number<=9 && tcp.len>0\"","g":true},{"l":"Calculation: Generic TCP","f":"transum.calculation == \"Generic TCP\"","g":true}]}],"fol":[["HTTP","tcp.stream eq 0"],["TCP","tcp.stream eq 0"]]}{"req":"frame", "frame":4, "columns":true}{"err":0,"col":["4","0.000319","192.168.3.85","192.168.3.78","HTTP","176","GET /MyApp/Home/About HTTP/1.1 "],"fol":[["HTTP","tcp.stream eq 0"],["TCP","tcp.stream eq 0"]]}{"req":"frame", "frame":4, "color":true}{"err":0,"bg":"e4ffc7","fg":"12272e","fol":[["HTTP","tcp.stream eq 0"],["TCP","tcp.stream eq 0"]]}{"req":"frame", "frame":4, "bytes":"true"}{"err":0,"bytes":"AAwp+/kTAAwp2dO1CABFAACimmFAAEAGGAHAqANVwKgDTrbfAFAefnCL/KwyboAYAOU0GwAAAQEICgSv6tUOKKxsR0VUIC9NeUFwcC9Ib21lL0Fib3V0IEhUVFAvMS4xDQpDb25uZWN0aW9uOiBjbG9zZQ0KVXNlci1BZ2VudDogSmFrYXJ0YSBDb21tb25zLUh0dHBDbGllbnQvMy4xDQpIb3N0OiB3ZWIwMQ0KDQo=","fol":[["HTTP","tcp.stream eq 0"],["TCP","tcp.stream eq 0"]]}

{"req":"frames","filter":"frame.number<=2"}[{"c":["1","0.000000","192.168.3.85","192.168.3.78","TCP","74","46815  80 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=78637781 TSecr=0 WS=128"],"num":1,"bg":"e4ffc7","fg":"12272e"},{"c":["2","0.000075","192.168.3.78","192.168.3.85","TCP","74","80  46815 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1 TSval=237546604 TSecr=78637781"],"num":2,"bg":"e4ffc7","fg":"12272e"}]{"req":"frames","limit":2}[{"c":["1","0.000000","192.168.3.85","192.168.3.78","TCP","74","46815  80 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=78637781 TSecr=0 WS=128"],"num":1,"bg":"e4ffc7","fg":"12272e"},{"c":["2","0.000075","192.168.3.78","192.168.3.85","TCP","74","80  46815 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1 TSval=237546604 TSecr=78637781"],"num":2,"bg":"e4ffc7","fg":"12272e"}]{"req":"frames","skip":2,"limit":2}[{"c":["3","0.000195","192.168.3.85","192.168.3.78","TCP","66","46815  80 [ACK] Seq=1 Ack=1 Win=29312 Len=0 TSval=78637781 TSecr=237546604"],"num":3,"bg":"e4ffc7","fg":"12272e"},{"c":["4","0.000319","192.168.3.85","192.168.3.78","HTTP","176","GET /MyApp/Home/About HTTP/1.1 "],"num":4,"bg":"e4ffc7","fg":"12272e"}]{"req":"frames","skip":2,"limit":1, "column0":20, "column1":"transum.art:1"}[{"c":["VMware_d9:d3:b5","0.000075000"],"num":1,"bg":"e4ffc7","fg":"12272e"}]

{"req":"info"}{"columns":[{"name":"802.1Q VLAN id","format":"%q"},..."stats":[{"name":"29West/Queues/Advertisements by Queue","tap":"stat:lbmr_queue_ads_queue"},..."ftypes":["FT_NONE","FT_PROTOCOL","FT_BOOLEAN","FT_CHAR","FT_UINT8","FT_UINT16","FT_UINT24","FT_UINT32",..."version":"v3.5.0rc0-595-g0d820ddc8d2d","nstat":[{"name":"A-I/F BSMAP Statistics","tap":"nstat:ansi_a,bsmap"},..."convs":[{"name":"Conversation List/Bluetooth","tap":"conv:Bluetooth"},..."seqa":[{"name":"All Flows","tap":"seqa:any"},..."taps":[{"name":"RTP streams","tap":"rtp-streams"},{"name":"Expert Information","tap":"expert"}],"eo":[{"name":"Export Object/DICOM","tap":"eo:dicom"},..."srt":[{"name":"Service Response Time/AFP","tap":"srt:afp"},..."rtd":[{"name":"Response Time Delay/H.225 RAS","tap":"rtd:h225_ras"},..."follow":[{"name":"Follow/HTTP","tap":"follow:HTTP"}, ... }

{"req":"intervals","filter":"frame.number<=60"}{"intervals":[[0,13,6812],[1,38,31459],[2,9,3775]],"last":2,"frames":60,"bytes":42046}{"req":"intervals","interval":100,"filter":"frame.number<=60"}{"intervals":[[0,12,6758],[1,1,54],[10,15,14783],[12,23,16676],[20,9,3775]],"last":20,"frames":60,"bytes":42046}

{"req":"iograph","graph0":"packets","filter0":"frame.number<=100"}{"iograph":[{"items":[13.000000,38.000000,23.000000,25.000000,1.000000]}]}{"req":"iograph","graph0":"sum:tcp.len","filter0":"http && frame.number<=100 && tcp.len"}{"iograph":[{"items":[2553.000000,4640.000000,955.000000,5416.000000]}]}{"req":"iograph","graph0":"sum:frame.len","filter0":"http && frame.number<=100 && frame.len","graph1":"sum:tcp.len","filter1":"http && frame.number<=100 && tcp.len"}{"iograph":[{"items":[2685.000000,4904.000000,1153.000000,5614.000000]},{"items":[2553.000000,4640.000000,955.000000,5416.000000]}]}{"req":"iograph","graph0":"http.request","filter0":"http && frame.number<=100 && http.request"}{"iograph":[]}

{"req":"load","file":"c:/traces/Contoso_01/web01/web01_00001_20161012151754.pcapng"}{"err":0}{"req":"load","file":"c:/traces/Contoso_01/web01/wrong_name.pcapng"}{"err":2}

{"req":"setcomment","frame":1,"comment":"Hello world"}{"err":0}{"req":"frame", "frame":1, "proto":"true"}{"err":0,"comment":"Hello world","tree":[{"l":"Packet comments","t":"proto","f":"pkt_comment","s":"Comment","e":10541,"n":[{"l":"Hello world","f":"frame.comment == \"Hello world\"","s":"Comment","e":55379,"n":[{"l":"Expert Info (Comment/Comment): Hello world","t":"pro ...

{"req":"setconf","name":"tcp.desegment_tcp_streams","value":false}{"err":0}{"req":"dumpconf","pref":"tcp.desegment_tcp_streams"}{"prefs":{"tcp.desegment_tcp_streams":{"b":0}}}{"req":"setconf","name":"tcp.desegment_tcp_streams","value":true}{"err":0}{"req":"dumpconf","pref":"tcp.desegment_tcp_streams"}{"prefs":{"tcp.desegment_tcp_streams":{"b":1}}}

{"req":"status"}{"frames":53882,"duration":1841.532335000,"filename":"web01_00001_20161012151754.pcapng","filesize":36433896}

{"req":"tap","tap0":"conv:Ethernet"}{"taps":[{"tap":"conv:Ethernet","type":"conv","convs":[{"saddr":"VMware_d9:d3:b5","daddr":"VMware_fb:f9:13","rxf":1,"rxb":74,"txf":1,"txb":74,"start":0.000000000,"stop":0.000075000,"filter":"eth.addr==00:0c:29:d9:d3:b5 && eth.addr==00:0c:29:fb:f9:13"}],"proto":"Ethernet","geoip":false}],"err":0}{"taps":[{"tap":"expert","type":"expert","details":[{"f":2,"s":"Chat","g":"Sequence","m":"Connection establish acknowledge (SYN+ACK): server port 80","p":"TCP"},{"f":1,"s":"Chat","g":"Sequence","m":"Connection establish request (SYN): server port 80","p":"TCP"}]}],"err":0}{"req":"tap","tap0":"seqa:tcp"}sharkd_session_process_tap() count=1{"taps":[{"tap":"seqa:tcp","type":"flow","nodes":["192.168.3.85","192.168.3.78"],"flows":[{"t":"0.000000","n":[0,1],"pn":[46815,80],"c":"Seq = 0"},{"t":"0.000075","n":[1,0],"pn":[80,46815],"c":"Seq = 0 Ack = 1"}]}],"err":0}{"req":"tap","tap0":"stat:http_req"}{"taps":[{"tap":"stats:http_req","type":"stats","name":"HTTP/Requests","stats":[{"name":"HTTP Requests by HTTP Host","count":1,"rate":0.1431,"perc":100,"burstrate":0.0100,"bursttime":0.000,"sub":[{"name":"web01","count":1,"rate":0.1431,"perc":100.00,"burstrate":0.0100,"bursttime":0.000,"sub":[{"name":"/MyApp/Home/About","count":1,"rate":0.1431,"perc":100.00,"burstrate":0.0100,"bursttime":0.000}]}]}]}],"err":0}