【Mac】TSharkを使ってTelnetのデータだけを取得する方法

brew install --cask wireshark

tshark -v
TShark (Wireshark) 4.4.1 (v4.4.1-0-g575b2bf4746e).

Copyright 1998-2024 Gerald Combs <gerald@wireshark.org> and contributors.
Licensed under the terms of the GNU General Public License (version 2 or later).
This is free software; see the file named COPYING in the distribution. There is
NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) using Clang 14.0.3 (clang-1403.0.22.14.1), with GLib 2.76.6,
with libpcap, without POSIX capabilities, with zlib 1.2.11, with zlib-ng 2.1.6,
with PCRE2, with Lua 5.4.6, with GnuTLS 3.8.4 and PKCS #11 support, with Gcrypt
1.10.2, with Kerberos (MIT), with MaxMind, with nghttp2 1.56.0, with nghttp3
0.15.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.11.9,
with libsmi 0.4.8, with binary plugins.

Running on macOS 15.0.1, build 24A348 (Darwin 24.0.0), with Apple M2, with 16384
MB of physical memory, with GLib 2.76.6, with libpcap 1.10.1, with zlib 1.2.12,
with PCRE2 10.39 2021-10-29, with c-ares 1.19.1, with GnuTLS 3.8.4, with Gcrypt
1.10.2, with nghttp2 1.56.0, with nghttp3 0.15.0, with brotli 1.0.9, with LZ4
1.9.4, with Zstandard 1.5.5, with libsmi 0.4.8, with LC_TYPE=UTF-8, binary
plugins supported.

tshark -D
1. ap1
2. en0 (Wi-Fi)
3. awdl0
4. llw0
5. utun0
6. utun1
7. utun2
8. utun3
9. utun4
10. utun5
11. utun6
12. utun7
13. bridge100
14. vmenet0
15. vmenet1
16. bridge101
17. lo0 (Loopback)
18. anpi0
19. anpi1
20. en3 (Ethernet Adapter (en3))
21. en4 (Ethernet Adapter (en4))
21. en5 (Ethernet Adapter (en5))

tshark -i en5 -Y "telnet"

tshark -i en5 -Y "telnet"
Capturing on 'USB 10/100/1000 LAN: en5'
  322  33.319773 192.168.100.254 → 192.168.100.2 TELNET 81 Will Suppress Go Ahead, Do Echo, Do Negotiate About Window Size, Will Status, Do Remote Flow Control
  324  33.321138 192.168.100.2 → 192.168.100.254 TELNET 93 Will Authentication Option, Do Suppress Go Ahead, Will Terminal Type, Will Negotiate About Window Size, Will Terminal Speed, …
  325  33.321494 192.168.100.254 → 192.168.100.2 TELNET 81 Don't Authentication Option, Do Terminal Type, Do Terminal Speed, Don't Linemode, Don't New Environment Option
  326  33.321617 192.168.100.2 → 192.168.100.254 TELNET 78 Won't Echo, Suboption Negotiate About Window Size
  327  33.322017 192.168.100.254 → 192.168.100.2 TELNET 81 Will Echo, 12 bytes data
  329  33.322267 192.168.100.2 → 192.168.100.254 TELNET 69 Do Echo
  358  47.728030 192.168.100.2 → 192.168.100.254 TELNET 68 2 bytes data
  359  47.728658 192.168.100.254 → 192.168.100.2 TELNET 78 12 bytes data
  372  54.023539 192.168.100.2 → 192.168.100.254 TELNET 67 1 byte data
  373  54.024094 192.168.100.254 → 192.168.100.2 TELNET 67 1 byte data
  375  54.057295 192.168.100.2 → 192.168.100.254 TELNET 67 1 byte data
  376  54.057730 192.168.100.254 → 192.168.100.2 TELNET 67 1 byte data
  378  54.140202 192.168.100.2 → 192.168.100.254 TELNET 67 1 byte data
  379  54.140591 192.168.100.254 → 192.168.100.2 TELNET 67 1 byte data

tshark -i en5 -Y "telnet" -V

tshark -i en5 -Y "telnet" -V
Capturing on 'USB 10/100/1000 LAN: en5'
Frame 47: 68 bytes on wire (544 bits), 68 bytes captured (544 bits) on interface en5, id 0
    Section number: 1
    Interface id: 0 (en5)
        Interface name: en5
        Interface description: USB 10/100/1000 LAN
  省略
    [Timestamps]
        [Time since first frame in this TCP stream: 0.000000000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]
    [SEQ/ACK analysis]
        [Bytes in flight: 2]
        [Bytes sent since last PSH flag: 2]
    TCP payload (2 bytes)
Telnet
    Data: \r

tshark -i en5 -Y "telnet and ip.src==192.168.100.2" -T fields -e telnet.data

tshark -i en5 -Y "telnet and ip.src==192.168.100.2" -T fields -e telnet.data
Capturing on 'USB 10/100/1000 LAN: en5'
P
a
s
s
w
o
r
d
1
2
3
\r
\r