Fun with Unsniff scripting : save last few packets of each flow

There was a question on the Wireshark Q&A Site. A user wanted to apply a filter to only show the last few packets of all TCP flows. This can be done manually in Wireshark quite easily but the user had hundreds of flows and was looking for an automatic way to do this.

Here is a quick post with code that demonstrates how you can automate this and other custom analysis using Unsniff Network Analyzer.

Unsniff exposes an object model to scriptland. This means that flows (a.k.a streams), packets, user objects, PDUs are all top level objects. All you have to do is to grab the flows collection, then for each flow save the last 6 packets. Here is the script.

The main part of the code is

  • Get the StreamIndex
  • Iterate over all streams; for each stream; grab the last 5 packets
  • Add those packets to the new output file

To run this script ;

Run as

What you will end up with is a new capture file containing only the last 5 segments of each flow. See pictures below.

Output PCAP file only has last 6 segments per flow
Output PCAP file only has last 6 segments per flow

The automation capabilities of Unsniff can save precious time. Please visit the Unsniff Scripting Guide for more.

Author: Vivek Rajagopalan

Vivek Rajagopalan is the a lead developer for Trisul Network Analytics. Prior products were Unsniff Network Analyzer and Unbrowse SNMP. Loves working with packets , very high speed networks, and helping track down the bad guys on the internet.