Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been using Microsoft Network Monitor to capture traffic data, which will eventually be used for data mining purposes and attack detection. It would be much more convenient if I could export the capture to a .csv file. Is there any way to export the capture as a .csv, or, assuming the .cap file is parser friendly, is it possible to analyze the .cap file directly in a language such as Python?

share|improve this question
add comment

migrated from security.stackexchange.com Jun 25 '12 at 12:07

This question came from our site for Information security professionals.

3 Answers

up vote 3 down vote accepted

You can import the capture file into Wireshark (which understands a couple of dozen popular capture formats, including Microsoft's) and from there export the packet list to a CSV.

share|improve this answer
    
That did the trick. Thanks! –  quicksort Jun 25 '12 at 13:40
    
Ah. When I do load the file into Wireshark, it seems to omit the useful columns/fields that were present in Microsoft Network Monitor such as conversation ID, process name, etc. I'm guessing there's no workaround for this. –  quicksort Jun 26 '12 at 16:20
add comment

You can also use LogParser in order to convert the cap file into a CSV or even XML.
Check out this link: http://consultingblogs.emc.com/stuartpreston/archive/2006/02/22/2967.aspx

share|improve this answer
add comment

Just highlight the Frame Summary grid in the Microsoft Network Monitor, right click, and select all, and copy. The content of the whole capture grid will now be copied to clipboard as a tab separated text. Paste to Excel and save as CSV. You can now analyse the CSV in whichever tool you want.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.