Using the following command what modifications need to be made to get frame.time as epoch in tshark?
tshark -T fields -n -r btle.pcap -E separator=, -e frame.time -e btle_rf.access_address_offenses -e btle_rf.channel -e btle_rf.flags -e btle_rf.flags.access_address_offenses_valid -e btle_rf.flags.channel_aliased -e btle_rf.flags.crc_checked -e btle_rf.flags.crc_valid -e btle_rf.flags.decrypted -e btle_rf.flags.dewhitened -e btle_rf.flags.mic_checked -e btle_rf.flags.mic_valid -e btle_rf.flags.noise_dbm_valid -e btle_rf.flags.reference_access_address_valid -e btle_rf.flags.rfu.1 -e btle_rf.flags.rfu.2 -e btle_rf.flags.signal_dbm_valid -e btle_rf.noise_dbm -e btle_rf.reference_access_address -e btle_rf.signal_dbm -e btle_rf.signed_byte_unused -e btle_rf.unsigned_byte_unused -e btle_rf.word_unused>btle.csv
As long as you are running Wireshark 1.4.0 or later, you can try changing -e frame.time to -e frame.time_epoch. If you're running an older version of Wireshark, then I might suggest upgrading to a newer version.
With the latest stable version of Wireshark (2.2.7 as of this writing), all frame filters are documented in View -> Internals -> Supported Protocols -> Frame -> ... and you can always reference the online Display Filter Reference page as well.
Related
Look at two examples:
$ perl -e ' print -e "registrar" && -d _ ? "YES" : "NO" '
YES
$ perl -e ' print -e "registrar" && -l _ ? "YES" : "NO" '
The stat preceding -l _ wasn't an lstat at -e line 1.
-d and -l are both file test operators. Why second does not work? The stat preceding -l _ is same as for -d _.
Most of the file tests use stat, which follows symlinks; -l uses lstat because it makes no sense to follow one if you want to test if it itself is a symbolic link. Hence the error.
The diagnostics pragma can be used to give a more verbose explanation of errors and warnings, including this one:
$ perl -Mdiagnostics -E 'say -e "registrar" && -l _ ? "YES" : "NO" '
The stat preceding -l _ wasn't an lstat at -e line 1 (#1)
(F) It makes no sense to test the current stat buffer for symbolic
linkhood if the last stat that wrote to the stat buffer already went
past the symlink to get to the real file. Use an actual filename
instead.
Uncaught exception from user code:
The stat preceding -l _ wasn't an lstat at -e line 1.
If using perl 5.10 or newer, file tests can be directly chained without needing to be &&ed together. Doing this with -e and -l works since perl is smart enough to pick the appropriate stat function:
$ mkdir registrar
$ perl -E ' say -e -d "registrar" ? "YES" : "NO" '
YES
$ perl -E ' say -e -l "registrar" ? "YES" : "NO" '
NO
I actually need exists and not link. Is there short hand for that?
That shorthand notation only works for simple and-ing all the tests together, but you can call lstat directly to see if a file exists:
$ ln -s registrar registrar-link
$ perl -E 'say lstat "registrar" && ! -l _ ? "YES" : "NO" '
YES
$ perl -E 'say lstat "registrar-link" && ! -l _ ? "YES" : "NO" '
NO
$ perl -E 'say lstat "no-such-file" && ! -l _ ? "YES" : "NO" '
NO
And in a script as opposed to a one-liner, I'd use File::stat instead of the underscore notation.
When running the following command with xargs (GNU findutils) 4.7.0
xargs -n1 <<<"-d -e -n -o"
I get this output
-d
-o
Why is -e and -n not present in the output?
From man xargs:
[...] and executes the command (default is /bin/echo) [...]
So it runs:
echo -d
echo -e
echo -n
echo -o
But from man echo:
-n do not output the trailing newline
-e enable interpretation of backslash escapes
And echo -n outputs nothing, and echo -e outputs one empty newlines that you see in the output.
I have this list of files:
$ more files
one_this_2017_1_abc.txt
two_that_2018_1_abc.txt
three_another_2017_10.abc.txt
four_again_2018_10.abc.txt
five_back_2018_1a.abc.txt
I would like to get this output:
one_this_XXXX_YY_abc.txt
two_that_XXXX_YY_abc.txt
three_another_XXXX_YY.abc.txt
four_again_XXXX_YY.abc.txt
five_back_XXXX_YY.abc.txt
I am trying to remove the year and the bit after the year and replace them with another string--this is to generate test cases.
I can get the year just fine, but it's that one or two character piece after it I can't seem to match.
This should work, right?
~/test_cases
$ cat files | sed -e 's/_[[:digit:]]\{4\}_/_XXXX_/' -e 's/_[[:alnum:]]\{1,2\}_/_YY_/'
one_this_XXXX_YY_abc.txt
two_that_XXXX_YY_abc.txt
three_another_XXXX_10.abc.txt
four_again_XXXX_10.abc.txt
five_back_XXXX_1a.abc.txt
Except it doesn't for the 2 character cases.
$ cat files | sed -e 's/_[[:digit:]]\{4\}_/_XXXX_/' -e 's/_[[:alnum:]]\
{2\}_/_YY_/'
one_this_XXXX_1_abc.txt
two_that_XXXX_1_abc.txt
three_another_XXXX_10.abc.txt
four_again_XXXX_10.abc.txt
five_back_XXXX_1a.abc.txt
Doesn't work for the two character cases either, and this works not at all (but according to the docs it should):
$ cat files | sed -e 's/_[[:digit:]]\{4\}_/_XXXX_/' -e 's/_[[:alnum:]]\+_/_YY_/'
one_YY_XXXX_1_abc.txt
two_YY_XXXX_1_abc.txt
three_YY_XXXX_10.abc.txt
four_YY_XXXX_10.abc.txt
five_YY_XXXX_1a.abc.txt
Other random experiments that don't work:
$ cat files | sed -e 's/_[[:digit:]]\{4\}_/_XXXX_/' -e 's/_[a-zA-Z0-9]\+_/_YY_/'
one_YY_XXXX_1_abc.txt
two_YY_XXXX_1_abc.txt
three_YY_XXXX_10.abc.txt
four_YY_XXXX_10.abc.txt
five_YY_XXXX_1a.abc.txt
$ cat files | sed -e 's/_[[:digit:]]\{4\}_/_XXXX_/' -e 's/_[a-zA-Z0-9]\{1\}_/_YY_/'
one_this_XXXX_YY_abc.txt
two_that_XXXX_YY_abc.txt
three_another_XXXX_10.abc.txt
four_again_XXXX_10.abc.txt
five_back_XXXX_1a.abc.txt
$ cat files | sed -e 's/_[[:digit:]]\{4\}_/_XXXX_/' -e 's/_[a-zA-Z0-9]\{2\}_/_YY_/'
one_this_XXXX_1_abc.txt
two_that_XXXX_1_abc.txt
three_another_XXXX_10.abc.txt
four_again_XXXX_10.abc.txt
five_back_XXXX_1a.abc.txt
Tried with both GNU sed version 4.2.1 under Linux and sed (GNU sed) 4.4 under Cygwin.
And yes, I realize I can pipe this through multiple sed calls to get it to work, but that regex SHOULD work, right?
if your Input_file is same as shown sample then following may help you in same.
sed 's/\([^_]*\)_\([^_]*\)_\(.*_\)\(.*\)/\1_\2_XXXX_YY_\4/g' Input_file
Output will be as follows.
one_this_XXXX_YY_abc.txt
two_that_XXXX_YY_abc.txt
three_another_XXXX_YY_10.abc.txt
four_again_XXXX_YY_10.abc.txt
five_back_XXXX_YY_1a.abc.txt
"ls" behaves differently when its output is being piped:
> ls ???
bar foo
> ls ??? | cat
bar
foo
How does it know, and how would I do this in Perl?
In Perl, the -t file test operator indicates whether a filehandle
(including STDIN) is connected to a terminal.
There is also the -p test operator to indicate whether a filehandle
is attached to a pipe.
$ perl -e 'printf "term:%d, pipe:%d\n", -t STDIN, -p STDIN'
term:1, pipe:0
$ perl -e 'printf "term:%d, pipe:%d\n", -t STDIN, -p STDIN' < /tmp/foo
term:0, pipe:0
$ echo foo | perl -e 'printf "term:%d, pipe:%d\n", -t STDIN, -p STDIN'
term:0, pipe:1
File test operator documentation at perldoc -f -X.
use IO::Interactive qw(is_interactive);
is_interactive() or warn "Being piped\n";
I have the following extract from a script that fetches weather information from accuweather:
wget -O ./weather_raw $address
if [[ -s ./weather_raw ]]; then
egrep 'Currently|Forecast<\/title>|_31x31.gif' ./weather_raw > ./weather
sed -i '/AccuWeather\|Currently in/d' ./weather
sed -i -e 's/^[ \t]*//g' -e 's/<title>\|<\/title>\|<description>\|<\/description>//g' ./weather
sed -i -e 's/<img src="/\n/g' ./weather
sed -i '/^$/d' ./weather
sed -i -e 's/_31x31.*$//g' -e 's/^.*\/icons\///g' ./weather
sed -i -e '1s/.$//' -e '3s/.$//' -e '6s/.$//' ./weather
for (( i=2; i<=8; i+=3 ))
do
im=$(sed -n ${i}p ./weather)
sed -i $i"s/^.*$/$(test_image $im)/" ./weather
done
fi
The command that triggers the code above is in a conkyrc file and its ~/.conkyblue/accu_weather/rss/acc_rss. When I run the conkyrc script from the prompt, I get an error
sed: can't read /home/me/weather: No such file or directory
And indeed when I check, the "weather" file is not created. However if run the command ~/.conkyblue/accu_weather/rss/acc_rss directly from the prompt, it works as expected and create and puts content into the /home/me/weather file.
I don't know anything about the sed command although I'm trying to learn it as a result of this bother.
What could be the problem with the code. I don't think its a permission issue since the folder its writing into is my home folder and I of-course own it.
Thanks
It should have been created by egrep.
When you run your script, the weather directory will be created in the pwd of the script process.
Check and see why egrep does not create the file, or in which directory it created it.