0

I am looking over a CTF writeup and I have a problem in reproducing a single command: 

tshark -r challenge.pcapng usb.bDescriptorType and usb.urb_type==67 -T fields -e usb.bus_id -e usb.device_address -e usb.idVendor -e usb.idProduct

Is it correct, or how should I use the -T parameter?

schroeder
  • 123,438
  • 55
  • 284
  • 319
Lucian Nitescu
  • 1,802
  • 1
  • 13
  • 27

1 Answers1

1

Is it correct?

No.

usb.bDescriptorType and usb.urb_type==67 is a display/read filter, so you have to use a -Y flag with it, and put it in quotes:

tshark -r challenge.pcapng -Y "usb.bDescriptorType and usb.urb_type==67" -T fields -e usb.bus_id -e usb.device_address -e usb.idVendor -e usb.idProduct