Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to get ftp request_command field if 'use_json == True' #365

Closed
ReasonJinMing opened this issue Aug 22, 2019 · 2 comments
Closed

Unable to get ftp request_command field if 'use_json == True' #365

ReasonJinMing opened this issue Aug 22, 2019 · 2 comments
Labels
old-auto-close Reopen if still relevant

Comments

@ReasonJinMing
Copy link

图片
json contains the infomation, but pyshark cannot extract it

@KimiNewt
Copy link
Owner

Can you attach a sample capture? I think that if you're using the latest version it ought to be accessible (check your pkt.field_names)

@ReasonJinMing
Copy link
Author

ReasonJinMing commented Sep 3, 2019

Can you attach a sample capture? I think that if you're using the latest version it ought to be accessible (check your pkt.field_names)

1.1.7.107-34826 -- 1.2.174.140-21 FTP.pcap.zip
I‘m sorry for replying too late. I will give a more detailed description.
For the sample pcap file and pyshark version is 0.4.2.9, if opening with use_json mode, the result shows like the following.
json
However, if opening with pdml mode, the result shows like the following.
pdml
Clearly, there are differences between the two mode.Some packets with request_command field can be shown in pdml mode but cannot be shown in json mode.

@KimiNewt KimiNewt added the old-auto-close Reopen if still relevant label Jun 7, 2022
@KimiNewt KimiNewt closed this as completed Jun 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
old-auto-close Reopen if still relevant
Projects
None yet
Development

No branches or pull requests

2 participants