# Module created by Microsoft.PowerShell.Crescendo
class PowerShellCustomFunctionAttribute : System.Attribute {
[bool]$RequiresElevation
[string]$Source
PowerShellCustomFunctionAttribute() { $this.RequiresElevation = $false; $this.Source = "Microsoft.PowerShell.Crescendo" }
PowerShellCustomFunctionAttribute([bool]$rElevation) {
$this.RequiresElevation = $rElevation
$this.Source = "Microsoft.PowerShell.Crescendo"
}
}
function Start-TShark
{
[PowerShellCustomFunctionAttribute(RequiresElevation=$False)]
[CmdletBinding()]
param(
[Parameter()]
[String]$SetInterface,
[Parameter()]
[String]$SetCaptureFilter,
[Parameter()]
[Switch]$SetDataLinkType,
[Parameter()]
[Switch]$GetInterfaces,
[Parameter()]
[Switch]$GetDataLinkTypes,
[Parameter()]
[String]$Path,
[Parameter()]
[ValidateSet("pcap","pcapng","5views","btsnoop","commview-ncf","commview-ncfx","dct2000","erf","eyesdn","k12text","lanalyzer","logcat","logcat-brief","logcat-long","logcat-process","logcat-tag","logcat-thread","logcat-threadtime","logcat-time","modpcap","netmon1","netmon2","nettl","ngsniffer","ngwsniffer_1_1","ngwsniffer_2_0","nokiapcap","nsecpcap","nstrace10","nstrace20","nstrace30","nstrace35","observer","rf5","rh6_1pcap","snoop","suse6_3pcap","visual")]
[String]$SetFileType,
[Parameter()]
[String]$LogPath,
[Parameter()]
[ValidateScript(
{if ($_ -match "filesize:[0-9]+$")
{
$true
}
else
{
throw 'use filesize: followed by number which represents KiloBytes Example:- filesize:1024 this will output 1mb capture files.'
}
})]
[ArgumentCompleter(
{
param($cmd, $param, $wordToComplete)
# This is the duplicated part of the code in the [ValidateScipt] attribute.
[array] $validValues = [regex]"filesize:[0-9]+$"
$validValues -like "$wordToComplete*"
}
)]
[String]$SetFileCaptureSizeKB,
[Parameter()]
[ValidateScript(
{if ($_ -match "duration:[0-9]+$")
{
$true
}
else
{
throw 'use duration: followed by number which represents seconds in time Example:- duration:60 this will output a capture files 60 seconds apart.'
}
})]
[ArgumentCompleter(
{
param($cmd, $param, $wordToComplete)
# This is the duplicated part of the code in the [ValidateScipt] attribute.
[array] $validValues = [regex]"duration:[0-9]+$"
$validValues -like "$wordToComplete*"
}
)]
[String]$SetFileCaptureDuration,
[Parameter()]
[ValidateScript(
{if ($_ -match "files:[0-9]+$")
{
$true
}
else
{
throw 'use files: followed by number which represents the number of 5 in total to capture Example:- files:10 this will output 10 capture files and then replace.'
}
})]
[ArgumentCompleter(
{
param($cmd, $param, $wordToComplete)
# This is the duplicated part of the code in the [ValidateScipt] attribute.
[array] $validValues = [regex]"files:[0-9]+$"
$validValues -like "$wordToComplete*"
}
)]
[String]$SetNumberCaptureFiles,
[Parameter()]
[Switch]$GetVersion,
[Parameter()]
[String]$OpenFile,
[Parameter()]
[ValidateSet("expert","afp,srt","ancp,tree","ansi_a,bsmap","ansi_a,dtap","ansi_map","asap,stat","bacapp_instanceid,tree","bacapp_ip,tree","bacapp_objectid,tree","bacapp_service,tree","calcappprotocol,stat","camel,counter","camel,srt","collectd,tree","componentstatusprotocol,stat","conv,bluetooth","conv,dccp","conv,eth","conv,fc","conv,fddi","conv,ip","conv,ipv6","conv,ipx","conv,jxta","conv,mptcp","conv,ncp","conv,rsvp","conv,sctp","conv,sll","conv,tcp","conv,tr","conv,udp","conv,usb","conv,wlan","conv,wpan","conv,zbee_nwk","credentials","dcerpc,srt","dests,tree","dhcp,stat","diameter,avp","diameter,srt","dns,tree","endpoints,bluetooth","endpoints,dccp","endpoints,eth","endpoints,fc","endpoints,fddi","endpoints,ip","endpoints,ipv6","endpoints,ipx","endpoints,jxta","endpoints,mptcp","endpoints,ncp","endpoints,rsvp","endpoints,sctp","endpoints,sll","endpoints,tcp","endpoints,tr","endpoints,udp","endpoints,usb","endpoints,wlan","endpoints,wpan","endpoints,zbee_nwk","enrp,stat","expert","f1ap,tree","f5_tmm_dist,tree","f5_virt_dist,tree","fc,srt","flow,any","flow,icmp","flow,icmpv6","flow,lbm_uim","flow,tcp","follow,dccp","follow,http","follow,http2","follow,quic","follow,sip","follow,tcp","follow,tls","follow,udp","fractalgeneratorprotocol,stat","gsm_a","gsm_a,bssmap","gsm_a,dtap_cc","gsm_a,dtap_gmm","gsm_a,dtap_mm","gsm_a,dtap_rr","gsm_a,dtap_sacch","gsm_a,dtap_sm","gsm_a,dtap_sms","gsm_a,dtap_ss","gsm_a,dtap_tp","gsm_map,operation","gtp,srt","h225,counter","h225_ras,rtd","hart_ip,tree","hosts","hpfeeds,tree","http,stat","http,tree","http2,tree","http_req,tree","http_seq,tree","http_srv,tree","icmp,srt","icmpv6,srt","io,phs","io,stat","ip_hosts,tree","ip_srcdst,tree","ipv6_dests,tree","ipv6_hosts,tree","ipv6_ptype,tree","ipv6_srcdst,tree","isup_msg,tree","lbmr_queue_ads_queue,tree","lbmr_queue_ads_source,tree","lbmr_queue_queries_queue,tree","lbmr_queue_queries_receiver,tree","lbmr_topic_ads_source,tree","lbmr_topic_ads_topic,tree","lbmr_topic_ads_transport,tree","lbmr_topic_queries_pattern,tree","lbmr_topic_queries_pattern_receiver,tree","lbmr_topic_queries_receiver,tree","lbmr_topic_queries_topic,tree","ldap,srt","mac-lte,stat","megaco,rtd","mgcp,rtd","mtp3,msus","ncp,srt","ngap,tree","npm,stat","osmux,tree","pingpongprotocol,stat","plen,tree","proto,colinfo","ptype,tree","radius,rtd","rlc-lte,stat","rpc,programs","rpc,srt","rtp,streams","rtsp,stat","rtsp,tree","sametime,tree","scsi,srt","sctp,stat","sip,stat","smb,sids","smb,srt","smb2,srt","smpp_commands,tree","snmp,srt","ssprotocol,stat","sv","ucp_messages,tree","wsp,stat")]
[String]$GetStatistics
)
BEGIN {
$__PARAMETERMAP = @{
SetInterface = @{
OriginalName = '-i'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
SetCaptureFilter = @{
OriginalName = '-f'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
SetDataLinkType = @{
OriginalName = '-y'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'Switch'
ApplyToExecutable = $False
NoGap = $False
}
GetInterfaces = @{
OriginalName = '-D'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'Switch'
ApplyToExecutable = $False
NoGap = $False
}
GetDataLinkTypes = @{
OriginalName = '-L'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'Switch'
ApplyToExecutable = $False
NoGap = $False
}
Path = @{
OriginalName = '-w'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
SetFileType = @{
OriginalName = '-F'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
LogPath = @{
OriginalName = '--log-file'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
SetFileCaptureSizeKB = @{
OriginalName = '-b'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
SetFileCaptureDuration = @{
OriginalName = '-b'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
SetNumberCaptureFiles = @{
OriginalName = '-b'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
GetVersion = @{
OriginalName = '-v'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'Switch'
ApplyToExecutable = $False
NoGap = $False
}
OpenFile = @{
OriginalName = '-r'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
GetStatistics = @{
OriginalName = '-z'
OriginalPosition = '0'
Position = '2147483647'
ParameterType = 'String'
ApplyToExecutable = $False
NoGap = $False
}
}
$__outputHandlers = @{ Default = @{ StreamOutput = $true; Handler = { $input } } }
}
PROCESS {
$__boundParameters = $PSBoundParameters
$__defaultValueParameters = $PSCmdlet.MyInvocation.MyCommand.Parameters.Values.Where({$_.Attributes.Where({$_.TypeId.Name -eq "PSDefaultValueAttribute"})}).Name
$__defaultValueParameters.Where({ !$__boundParameters["$_"] }).ForEach({$__boundParameters["$_"] = get-variable -value $_})
$__commandArgs = @()
$MyInvocation.MyCommand.Parameters.Values.Where({$_.SwitchParameter -and $_.Name -notmatch "Debug|Whatif|Confirm|Verbose" -and ! $__boundParameters[$_.Name]}).ForEach({$__boundParameters[$_.Name] = [switch]::new($false)})
if ($__boundParameters["Debug"]){wait-debugger}
foreach ($paramName in $__boundParameters.Keys|
Where-Object {!$__PARAMETERMAP[$_].ApplyToExecutable}|
Sort-Object {$__PARAMETERMAP[$_].OriginalPosition}) {
$value = $__boundParameters[$paramName]
$param = $__PARAMETERMAP[$paramName]
if ($param) {
if ($value -is [switch]) {
if ($value.IsPresent) {
if ($param.OriginalName) { $__commandArgs += $param.OriginalName }
}
elseif ($param.DefaultMissingValue) { $__commandArgs += $param.DefaultMissingValue }
}
elseif ( $param.NoGap ) {
$pFmt = "{0}{1}"
if($value -match "\s") { $pFmt = "{0}""{1}""" }
$__commandArgs += $pFmt -f $param.OriginalName, $value
}
else {
if($param.OriginalName) { $__commandArgs += $param.OriginalName }
$__commandArgs += $value | Foreach-Object {$_}
}
}
}
$__commandArgs = $__commandArgs | Where-Object {$_ -ne $null}
if ($__boundParameters["Debug"]){wait-debugger}
if ( $__boundParameters["Verbose"]) {
Write-Verbose -Verbose -Message tshark.exe
$__commandArgs | Write-Verbose -Verbose
}
$__handlerInfo = $__outputHandlers[$PSCmdlet.ParameterSetName]
if (! $__handlerInfo ) {
$__handlerInfo = $__outputHandlers["Default"] # Guaranteed to be present
}
$__handler = $__handlerInfo.Handler
if ( $PSCmdlet.ShouldProcess("tshark.exe $__commandArgs")) {
# check for the application and throw if it cannot be found
if ( -not (Get-Command -ErrorAction Ignore "tshark.exe")) {
throw "Cannot find executable 'tshark.exe'"
}
if ( $__handlerInfo.StreamOutput ) {
& "tshark.exe" $__commandArgs | & $__handler
}
else {
$result = & "tshark.exe" $__commandArgs
& $__handler $result
}
}
} # end PROCESS
<#
.SYNOPSIS
This is allowing you to run TShark.exe in powershell using powershell
.DESCRIPTION
Inspired by Adam Driscoll and the Sysinternals module I wanted to do something similar
so bringing tshark to powershell. Although this module does not at the moment include
every single parameter tshark does, I still think it was worth bringing this to powershell
to act as another tool for the sysadmins tool-kit you have. I like hanging out in my shell
all day so this now allows me to easily use tshark from Powershell
.PARAMETER SetInterface
This is the same as the -i parameter in tshark but with a more helpful paramter name I think. So this
will set the name of the network interface to use for live packet capture. Please note to get a list
of YOUR valid network interfaces use the -GetInterface paramter first.
.PARAMETER SetCaptureFilter
Set the capture filter expression using wireshark syntax, to only filter on dns just simply type dns after this
parameter name. Please do not use this if you are un-sure of the syntax, you can always filter the capture file in the
wireshark GUI after the capture is complete.
.PARAMETER SetDataLinkType
Set the data link type to use while capturing packets. The values reported by -GetDataLinkTypes are the values that can be used
as the value for this parameter
.PARAMETER GetInterfaces
Print a list of the interfaces on which TShark can capture, and exit. For each network interface, a number and an interface name,
possibly followed by a text description of the interface, is printed. The interface name or the number can be supplied to the -SetInterface option to specify an interface on which to capture.
.PARAMETER GetDataLinkTypes
List the data link types supported by the interface and exit. The reported link types can be used with the -SetDataLinkTypes
parameter
.PARAMETER Path
Type the full file output path you want the file to go to including the file name and file extension. For example:-
-Path C:\Users\MyAccount\MyCapture.pcapng
.PARAMETER SetFileType
This allows you to see all the possible file extension output types. So you can select a different output to the default
pcapng format should you so wish to. Please remember to also specify this in the -Path value the parameter file-type
extension you selected
.PARAMETER LogPath
This will allow you to specify a .txt or .log file to output messages to that appear on the screen during the capture
.PARAMETER SetFileCaptureSizeKB
This is using the capture ring buffer option from tshark -b and using this to set the file size for the capture you wish to
perform. After using this parameter name press TAB to auto-complete the parameter validation pattern
.PARAMETER SetFileCaptureDuration
This is using the capture ring buffer option from tshark -b this will set the amount of time in seconds that the capture is taken for to a file before going to the next file.
After using this parameter name press TAB to auto-complete the parameter validation pattern
.PARAMETER SetNumberCaptureFiles
This is using the capture ring buffer option from tshark -b allowing you to set the number of rotating capture files you wish to
capture. You would use this parameter in with either the -SetFileCaptureSizeKB or -SetFileCaptureDuration to allow you to
fix the amount of files to store in the output directory. This will allow you to keep a trace running for days without flooding
the hard drive full of data. After using this parameter name press TAB to auto-complete the parameter validation pattern
.PARAMETER GetVersion
This will display the current version of tshark you are using in the background to perform the task at hand.
.PARAMETER OpenFile
Allows you to display a capture file within the Powershell window you have open, should you wish to do some quick analysis
on the capture
.PARAMETER GetStatistics
This allows you to choose from a large choice of statistics to display after it has opened the capture file. This is very
useful to gain certain insights or to just get the expert statistics
.EXAMPLE
Start-TShark -Path C:\Zelda.pcapng -SetFileCaptureSizeKB filesize:10240 -SetNumberCaptureFiles files:10
This will output a rotating set of 10 files which will be 10MB in size. Pressing CTRL+C to exit the capture after the
desired issue has been captured
.EXAMPLE
Start-TShark -SetInterface "Wi-Fi" -Path C:\DnsOutput.pcapng -LogPath C:\DnsOutput.txt
This will being a capture on the Wi-Fi network interface, outputting to a .pcapng file and also record the output
from messages on the Powershell screen to the log file specified in the -LogPath this file capture will continue
to capture information until CTRL+C is pressed to stop the capture
.EXAMPLE
Start-TShark -OpenFile C:\SlowNetwork.pcapng -GetStatistics expert
Will open the capture file specified in the -OpenFile parameter, this will also then provide you with the expert analysis
information by specifying that value from the pre-defined list of choices on the -GetStatistics parameter
.FUNCTIONALITY
To use when you have a weird network issue you have been told to fix, allowing you to collect packet information to analyze
in Wireshark
#>
}
Function Install-TShark {
if (Test-Path "$env:USERPROFILE\scoop")
{
Write-Host -ForegroundColor Yellow "Awesome it looks like you have scoop installed, checking to see if TShark present."
if (Test-Path "$env:USERPROFILE\scoop\shims\tshark.exe")
{
Write-Host -ForegroundColor Yellow "It appears you have TShark installed you are all good to use Start-TShark now"
}
else {
scoop install wireshark
}
}
else
{
Write-Host -ForegroundColor Yellow "I am now installing scoop for you and TShark, then you can use Start-TShark once complete."
Invoke-Expression (New-Object System.Net.WebClient).DownloadString('https://get.scoop.sh')
scoop install git
scoop bucket add extras
scoop install wireshark
Write-Host -ForegroundColor Yellow "All done have a great day."
}
}
