Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using Microsoft Network Monitor to capture traffic data, which will eventually be used for data mining purposes and attack detection. It would be much more convenient if I could export the capture to a .csv file. Is there any way to export the capture as a .csv, or, assuming the .cap file is parser friendly, is it possible to analyze the .cap file directly in a language such as Python?

share|improve this question

migrated from Jun 25 '12 at 12:07

This question came from our site for information security professionals.

up vote 3 down vote accepted

You can import the capture file into Wireshark (which understands a couple of dozen popular capture formats, including Microsoft's) and from there export the packet list to a CSV.

share|improve this answer
That did the trick. Thanks! – quicksort Jun 25 '12 at 13:40
Ah. When I do load the file into Wireshark, it seems to omit the useful columns/fields that were present in Microsoft Network Monitor such as conversation ID, process name, etc. I'm guessing there's no workaround for this. – quicksort Jun 26 '12 at 16:20

Just highlight the Frame Summary grid in the Microsoft Network Monitor, right click, and select all, and copy. The content of the whole capture grid will now be copied to clipboard as a tab separated text. Paste to Excel and save as CSV. You can now analyse the CSV in whichever tool you want.

share|improve this answer

You can also use LogParser in order to convert the cap file into a CSV or even XML.
Check out this link:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.