我正在尝试制作一个Power Shell脚本，以便可以从指定接口上的捕获中获取tshark输出文件并对其进行分析。目前，我可以指定要捕获的接口和执行捕获的时间，但是输出全部压缩为单行。
我将如何格式化下面的tshark输出和统计信息表以使其更具可读性，或者恢复为单独运行该工具时tshark最初显示的格式？
#Capture the Client Subnets for the Tap/SPAN
param([string[]]$subnets)
$ErrorActionPreference = 'SilentlyContinue'
#Capture variables
$shark = ".\tshark.exe"
$flagshark = "-i"
$interfaceshark = ".\tshark.exe -D"
Invoke-Expression $interfaceshark
$userinterface = Read-Host -Prompt 'Input the number beside the interface that you would like to capture?'
$time = Read-Host -Prompt 'How much time would you like to capture for the assessment?'
#Run Tshark
& $shark -i "$userinterface" -a duration:"$time" -w testingoutput.pcap
foreach ($nets in $subnets) {
$analysis = '.\tshark.exe -r testingoutput.pcap -2 -R "ip.addr == $nets" -z conv,ip'
$result = Invoke-Expression $analysis
Write-Host $result | Format-Table -AutoSize
}
这是我想要的输出：
84 0.707630 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161
85 0.751054 52.112.6.179 → 10.201.0.49 UDP 116 57560 → 50052 Len=74
86 0.751055 52.112.6.179 → 10.201.0.49 UDP 1097 57560 → 50052 Len=1055
87 0.751055 52.112.6.179 → 10.201.0.49 UDP 1097 57560 → 50052 Len=1055
88 0.751057 52.112.6.179 → 10.201.0.49 UDP 1097 57560 → 50052 Len=1055
89 0.751057 52.112.6.179 → 10.201.0.49 UDP 1097 57560 → 50052 Len=1055
90 0.751058 52.112.6.179 → 10.201.0.49 UDP 1097 57560 → 50052 Len=1055
91 0.751198 52.112.6.179 → 10.201.0.49 UDP 1097 57560 → 50052 Len=1055
92 0.751199 52.112.6.179 → 10.201.0.49 UDP 1097 57560 → 50052 Len=1055
93 0.751199 52.112.6.179 → 10.201.0.49 UDP 1096 57560 → 50052 Len=1054
94 0.751200 52.112.6.179 → 10.201.0.49 UDP 304 57560 → 50052 Len=262
95 0.752471 52.112.6.179 → 10.201.0.49 UDP 93 54450 → 50000 Len=51
96 0.767686 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161
97 0.827670 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161
97 packets captured
==============================================================================
IPv4 Conversations
Filter:<No Filter>
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
10.201.0.49 <-> 52.112.6.179 78 26413 11 6395 89 32808 0.000000000 0.8277
10.201.0.1 <-> 224.0.0.10 0 0 2 160 2 160 0.379198000 0.1439
10.201.0.49 <-> 165.225.34.36 1 107 1 54 2 161 0.624698000 0.0405
10.201.0.16 <-> 239.255.255.250 0 0 1 216 1 216 0.088173000 0.0000
10.201.0.40 <-> 239.255.255.250 0 0 1 216 1 216 0.090642000 0.0000
==============================================================================
这是我目前得到的：
91 0.549731 52.112.6.179 → 10.201.0.49 STUN 130 Binding Success Response XOR-MAPPED-ADDRESS: 206.27.171.242:50000 user: c6Si:m9Dx 92 0.565386 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161 93 0.584513 5
2.112.6.179 → 10.201.0.49 UDP 116 57560 → 50052 Len=74 94 0.584513 52.112.6.179 → 10.201.0.49 UDP 177 57560 → 50052 Len=135 95 0.584513 52.112.6.179 → 10.201.0.49 UDP 156 57560 → 50052 Len=114 96 0.584513 52.112.6.179 → 10.201
.0.49 UDP 219 57560 → 50052 Len=177 97 0.584514 52.112.6.179 → 10.201.0.49 UDP 395 57560 → 50052 Len=353 98 0.584514 52.112.6.179 → 10.201.0.49 UDP 395 57560 → 50052 Len=353 99 0.584516 52.112.6.179 → 10.201.0.49 UDP 395 57560
→ 50052 Len=353 100 0.584516 52.112.6.179 → 10.201.0.49 UDP 394 57560 → 50052 Len=352 101 0.584661 52.112.6.179 → 10.201.0.49 UDP 411 57560 → 50052 Len=369 102 0.625153 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161 1
03 0.659342 52.112.6.179 → 10.201.0.49 UDP 1196 57560 → 50052 Len=1154 104 0.686102 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161 105 0.731077 52.112.6.179 → 10.201.0.49 UDP 116 57560 → 50052 Len=74 106 0.731077 52.112
.6.179 → 10.201.0.49 UDP 177 57560 → 50052 Len=135 107 0.731078 52.112.6.179 → 10.201.0.49 UDP 156 57560 → 50052 Len=114 108 0.731078 52.112.6.179 → 10.201.0.49 UDP 213 57560 → 50052 Len=171 109 0.731079 52.112.6.179 → 10.201.0.4
9 UDP 403 57560 → 50052 Len=361 110 0.731079 52.112.6.179 → 10.201.0.49 UDP 403 57560 → 50052 Len=361 111 0.731079 52.112.6.179 → 10.201.0.49 UDP 403 57560 → 50052 Len=361 112 0.731080 52.112.6.179 → 10.201.0.49 UDP 403 57560 →
50052 Len=361 113 0.731081 52.112.6.179 → 10.201.0.49 UDP 403 57560 → 50052 Len=361 114 0.731086 52.112.6.179 → 10.201.0.49 UDP 400 57560 → 50052 Len=358 115 0.731086 52.112.6.179 → 10.201.0.49 UDP 419 57560 → 50052 Len=377 116
0.745221 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161 117 0.784472 52.112.6.179 → 10.201.0.49 UDP 450 57560 → 50052 Len=408 118 0.805436 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161 119 0.855067 52.112.6.17
9 → 10.201.0.49 UDP 116 57560 → 50052 Len=74 120 0.855068 52.112.6.179 → 10.201.0.49 UDP 177 57560 → 50052 Len=135 121 0.855068 52.112.6.179 → 10.201.0.49 UDP 156 57560 → 50052 Len=114 122 0.855069 52.112.6.179 → 10.201.0.49 UDP
210 57560 → 50052 Len=168 123 0.855069 52.112.6.179 → 10.201.0.49 UDP 442 57560 → 50052 Len=400 124 0.855070 52.112.6.179 → 10.201.0.49 UDP 442 57560 → 50052 Len=400 125 0.855071 52.112.6.179 → 10.201.0.49 UDP 458 57560 → 50052
Len=416 126 0.865431 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161 127 0.924276 52.112.6.179 → 10.201.0.49 UDP 222 57560 → 50052 Len=180 128 0.925249 52.112.6.179 → 10.201.0.49 UDP 203 54450 → 50000 Len=161 129 0.930
466 10.201.0.49 → 165.225.34.36 TCP 235 1091 → 80 [PSH, ACK] Seq=1 Ack=1 Win=1026 Len=181 130 0.985159 52.112.6.179 → 10.201.0.49 UDP 116 57560 → 50052 Len=74 ================================================================================ IPv4
Conversations Filter:<No Filter> | <- | | -> | | Total | Relative | Duration | | Frames Bytes | | Frames Bytes | | Frames
Bytes | Start | | 10.201.0.49 <-> 52.112.6.179 121 73200 4 742 125 73942 0.000000000 0.9852 10.201.0.49 <-> 52.112.67.77 2 250 1 54
3 304 0.280012000 0.0001 10.201.0.1 <-> 224.0.0.10 0 0 1 80 1 80 0.494976000 0.0000 10.201.0.49 <-> 165.225.34.36 0 0 1 235
1 235 0.930466000 0.0000 ================================================================================
答案 0 :(得分：2)
将obfuscate更改为zipRev xs ys = obfuscate (\accum -> foldr f accum xs) id snd (ys,[])
zipRev xs ys = id (snd . (\accum -> foldr f accum xs)) (ys,[])
zipRev xs ys = snd (foldr f (ys,[]) xs)
。将Write-Host $result | Format-Table -AutoSize的内容转储到主机后，就无法再通过管道将其传输到$result cmdlet。使用$result毫无意义，因为您收到一个Format-Table数组，在这里必须将几列分开以使其用于Format-Table。
要将给定的字符串转换为我想到的PowerShell自定义对象数组：
string现在Format-Table是PowerShell对象的数组。如果我转储数组的第一个对象：
PS C:\> $result = iex '.\tshark.exe -r C:\temp\test.pcapng -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto -e _ws.col.Info -E header=y -E separator="," -E quote=d -E occurrence=f' | ConvertFrom-Csv
您看到该对象具有多个属性。要查看所有可用的对象属性，我们可以使用$result cmdlet：
PS C:\> $result | Select-Object -First 1
frame.number : 1
frame.time : May 14, 2019 06:59:40.011932000 W. Europe Daylight Time
eth.src : b0:fa:eb:1e:8f:a1
eth.dst : 00:50:56:a4:24:eb
ip.src : 172.22.21.50
ip.dst : 10.22.23.98
ip.proto : 17
_ws.col.Info : 58842  3389 Len=12
上面您看到了可用于进一步过滤，排序（例如Get-Member）或通过PS C:\> $result[0] | Get-Member
TypeName: Selected.System.Management.Automation.PSCustomObject
Name MemberType Definition
---- ---------- ----------
Equals Method bool Equals(System.Object obj)
GetHashCode Method int GetHashCode()
GetType Method type GetType()
ToString Method string ToString()
eth.dst NoteProperty string eth.dst=00:50:56:a4:24:eb
eth.src NoteProperty string eth.src=b0:fa:eb:1e:8f:a1
frame.number NoteProperty string frame.number=1
frame.time NoteProperty string frame.time=May 14, 2019 06:59:40.011932000 W. Europe Daylight Time
ip.dst NoteProperty string ip.dst=10.22.23.98
ip.proto NoteProperty string ip.proto=17
ip.src NoteProperty string ip.src=172.22.21.50
_ws.col.Info NoteProperty string _ws.col.Info=58842  3389 Len=12
cmdlet选择多个属性的几个属性。
示例：
$result | Sort-Object ip.dst希望有帮助。