Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ?

Regards, Mithun

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

Open up Wireshark, select your .cap file, and then go to File->Export and choose the options that you want.

So, if you need to do it from the command line, use tshark.exe, as follows.

>tshark -i - < "c:\filename.cap" > "c:\output.txt

If you want to write the decoded form of packets to a file, run TShark without the -w option, and redirect its standard output to the file (do not use the -w option).

share|improve this answer
    
File->Save As also has numerous formats. –  David Jun 10 '10 at 16:58
    
@David - none of those are human-readable, they're all meant for use with other traffic analyzers. "Export" is the one that gets you friendly text files, or structured things like PS, CSV, etc. –  mfinni Jun 10 '10 at 17:02
    
am sorry I forgot to mention . I want to convert it using some command line ? –  user26202 Jun 10 '10 at 17:31
    
OK, edited my answer to include command-line options. @Davey, below, also posted a good answer using an additional tool you may or may not have, tcpdump. –  mfinni Jun 10 '10 at 19:40
add comment

The -A option of tcpdump prints each packet in human readable ASCII and happily deals with wireshark files and you can do it all from the command line:

tcpdump -A -r stackoverflow.cap > stackoverflow.txt

The output looks like:

9:22:33.664874 IP 192.168.1.11.33874 > stackoverflow.com.www: Flags [P.], seq 1117095075:1117095829, ack 3371415182, win 9648, options [nop,nop,TS val 9533909 ecr 313735664], length 754
E..&..@.@../....E;...R.PB.........%........
..y...9.GET / HTTP/1.1
Host: serverfault.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-141773580-1259521886021; __utmz=81883924.1275328201.133.5.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=hudson%20build%20dir; usr=t=kXSBoIG5Jk6S&s=wGmaIuhAD0eH; __utma=81883924.2034104685.1272993451.1276186265.1276193655.189; __utmc=81883924; __utmb=81883924.6.10.1276193655
If-Modified-Since: Thu, 10 Jun 2010 10:17:12 GMT
share|improve this answer
    
Assuming he's running on Unix. Or running WinDump or other Windows clone of TCPDump. Since the guy mentioned Wireshark, I limited my answer to the tools included in the Wireshark package. –  mfinni Jun 10 '10 at 18:32
add comment

Aren't you able to open wireshark and open that .cap file, then export it from the file menu as a text file? Trying to remember off the top of my head but I thought you could...

share|improve this answer
    
am sorry I forgot to mention . I want to convert it using some command line ? –  user26202 Jun 10 '10 at 17:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.