up vote 0 down vote favorite
share [g+] share [fb]

Does anyone know how I would go about extracting urls in w3c extended log format from a wireshark pcap capture file?

Thanks

link|improve this question
50% accept rate
I may be misunderstanding your question, but Wireshark doesn't do that. It's not a log parsing tool (that I'm aware of) it's a packet capture program. – joeqwerty Sep 24 '10 at 11:21
i know wireshark doesn't do that. I'm wondering how I can parse a wireshark file and output a http log file. – Mike Sep 24 '10 at 11:35
I don't think that's possible. How about looking at the log file on the web server? – joeqwerty Sep 24 '10 at 13:12
feedback

1 Answer

up vote 0 down vote accepted

Not practical with Wireshark but have a look at this: http://chaosreader.sourceforge.net/

This is a type of "any-snarf" program, as it will fetch ... HTTP transfersfrom the captured data inside network traffic logs. A html index file is created that links to ... reports such as image reports and HTTP GET/POST content reports.

I don't think the reports are in w3c extended log format but...why so strict? Surely a bit a perl will let you munge them into w3c extended log format.

See http://isc.sans.edu/diary.html?storyid=6961 for more leads.

link|improve this answer
Thank you so much. This is exactly what I'm looking for. I've been able to convert that output into w3c logs. Thanks again! – Mike Sep 25 '10 at 0:38
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.