I'm trying to get the TCPStream from a capture, with size 24M. I can get it with wireshark but I need a command without interface to get this.
I started by trying the TShark in captures of less than 1M, and I was able to get tcpstream equal to wireshark in the same capture. In the capture with 24M, I can't. The TCPStream in wireshark is large and does not match what is given in TShark.
I can not understand what the problem is.
I'm using the following command: tshark -r cap.pcapng -T fields -e data
Any idea what the problem might be? Or what is it related to?
I'm available also for other solutions that can solve my problem.
Thanks.