CODEWITHSUNDEEP
network-programmingwiresharktsharkwifi
Aman Deep Gautam
Aman Deep Gautam

Reputation: 8787

Getting particular information out of pcap files

I am interested in particular information in the .pcap (Frame control field). I want to extract it to a text file and then do graph plotting using the extracted data. I can do export to text file using wireshark but I am looking for automating the process.

As of now I know that Tshark can be used to convert .pcap to text files but then it outputs the whole packet. Instead I am interested in only one particular information.

Is there some nice way to do this.

Upvotes: 0

Views: 642

Answers (1)

willyo
willyo

Reputation: 1001

Is there some nice way to do this.

Could be.

If the field you wish to extract has a filter, the you can use tshark to output just that field using the -T and -e switches;

tshark -Tfields -e tcp.port -r ....

See tshark -h for details...

To use wireshark to see the name for a field, click on the field in the details pane and then note the field name shown in the bottom status bar.

Which field(s) specifically do you want ? from what protocol ?

Upvotes: 2

Related Questions