tshark导出FIX消息(tshark export FIX messages)

 目标 
 
 我正在努力实现以下目标： 
 
 
 
 捕获包含FIX协议中的会话的网络流量 
 
 
 将来自网络流量的各个FIX消息提取为“漂亮”格式，例如CSV 
 
 
 对导出的“漂亮”格式数据进行一些数据分析 
 
 
 我通过以下方式实现了： 
 
 
 
 使用pcap捕获网络流量 
 
 
 使用tshark以CSV格式打印相关数据 
 
 
 使用Python（pandas）来分析数据 
 
 
 问题 
 
 问题是一些捕获的TCP数据包包含多个FIX消息，这意味着当我使用tshark导出到CSV时，我没有得到每行的FIX消息。 这使得消费CSV变得困难。 
 
 这是我用来提取相关FIX字段的tshark命令行，因为CSV是： 
 
tshark -r dump.pcap \
-R \'(fix.MsgType[0]=="G" or fix.MsgType[0]=="D" or fix.MsgType[0]=="8" or \ fix.MsgType[0]=="F") and fix.ClOrdID != "0"\' \ 
-Tfields -Eseparator=, -Eoccurrence=l -e frame.time_relative \
-e fix.MsgType -e fix.SenderCompID \
-e fix.SenderSubID -e fix.Symbol -e fix.Side \
-e fix.Price -e fix.OrderQty -e fix.ClOrdID \
-e fix.OrderID -e fix.OrdStatus'
 
 请注意，我正在使用“-Eoccurrence = l”来获取在数据包中出现多个字段的情况下最后一次出现的命名字段。 这不是一个可接受的解决方案，因为当数据包中有多个FIX消息时，信息将被丢弃。 
 
 这是我期望在导出的CSV文件中的每一行（来自一个FIX消息的字段）中看到的内容： 
 
16.508949000,D,XXX,XXX,YTZ2,2,97480,34,646427,,
 
 这是我在TCP数据包中有多个FIX消息（三个是这种情况）并且使用命令行标志“-Eoccurrence = a”时看到的： 
 
16.515886000,F,F,G,XXX,XXX,XXX,XXX,XXX,XXX,XTZ2,2,97015,22,646429,646430,646431,323180,323175,301151,
 
 问题 
 
 有没有办法（不一定使用tshark）从pcap文件中提取每个特定于协议的消息？ 

The Objective
 
I'm trying to achieve the following:
 
 
 
capture network traffic containing a conversation in the FIX protocol
 
 
extract the individual FIX messages from the network traffic into a "nice" format, e.g. CSV
 
 
do some data analysis on the exported "nice" format data
 
 
I have achieved this by:
 
 
 
using pcap to capture the network traffic
 
 
using tshark to print the relevant data as a CSV
 
 
using Python (pandas) to analyse the data
 
 
The Problem
 
The problem is that some of the captured TCP packets contain more than one FIX message, which means that when I do the export to CSV using tshark I don't get a FIX message per line. This makes consuming the CSV difficult.
 
This is the tshark commandline I'm using to extract the relevant FIX fields as CSV is:
 
tshark -r dump.pcap \
-R \'(fix.MsgType[0]=="G" or fix.MsgType[0]=="D" or fix.MsgType[0]=="8" or \ fix.MsgType[0]=="F") and fix.ClOrdID != "0"\' \ 
-Tfields -Eseparator=, -Eoccurrence=l -e frame.time_relative \
-e fix.MsgType -e fix.SenderCompID \
-e fix.SenderSubID -e fix.Symbol -e fix.Side \
-e fix.Price -e fix.OrderQty -e fix.ClOrdID \
-e fix.OrderID -e fix.OrdStatus'
 
Note that I'm currently using "-Eoccurrence=l" to get just the last occurrence of a named field in the case where there is more than one occurrence of a field in the packet. This is not an acceptable solution as information will get thrown away when there are multiple FIX messages in a packet.
 
This is what I expect to see per line in the exported CSV file (fields from one FIX message):
 
16.508949000,D,XXX,XXX,YTZ2,2,97480,34,646427,,
 
This is what I see when there is more than one FIX message (three is this case) in a TCP packet and the commandline flag "-Eoccurrence=a" is used:
 
16.515886000,F,F,G,XXX,XXX,XXX,XXX,XXX,XXX,XTZ2,2,97015,22,646429,646430,646431,323180,323175,301151,
 
The Question
 
Is there a way (not necessarily using tshark) to extract each individual, protocol specific message from a pcap file?

原文：https://stackoverflow.com/questions/13810156