Creating an Interactive Bash Script to Analyze a PCAP

Shell Programming and Scripting
1

Hello Everyone,

I am currently trying to write a Bash Script to call a PCAP file. The command I will use in the script will be the following:

tshark -r test.pcap -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -r ip.proto -E header=y -E separator=, quote=d -E occurance=f > pcap.csv

This command will allow me to see everything I need in a nicely formatted CSV file however I am struggling to write an interactive script to input both the name of the pcap (testfile.pcap above) and the name of the csv file (testfile.csv above) for the output to be saved to.

Does anyone know how I could put this into an interactive script so that when an admin runs the script, they can input the name of the existing pcap and the name of the csv file that the formatted information should be saved to?

So far my script contains the following:
#!/bin/bash

echo="What is the name of your PCAP input file?"

echo="What is the name of your CSV output file?

tshark -r test.pcap -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -r ip.proto -E header=y -E separator=, quote=d -E occurance=f > pcap.csv

I have been watching and reading a lot about bash scripting and I think the test.pcap and pcap.csv above should each be a variable but how do I make a variable represent something input by a user? Essentially I would like the user to be able to enter in the name of the pcap (and location if need be) to analyze, followed by the name of the csv file to send the output to.

Thanks in advance!

Tuxor

2 
#!/bin/bash

echo -n "What is the name of your PCAP input file? "
read in_pcap

echo -n "What is the name of your CSV output file? "
read out_csv

tshark -r "$in_pcap" -T fields -e frame.number -e frame.time \
-e eth.src -e eth.dst -e ip.src -e ip.dst -r ip.proto -E header=y -E separator=, quote=d -E occurance=f > "$out_csv"
1 Like
3

When the user specifies the in_pcap (the pcap that already exists), will they have to specify the path of the pcap so that the script knows what pcap to run the script on?

4

If it's in the current directory, they don't need to give the path. If it's not, they do need to give the path.

1 Like
5

Thank both of you very much!