How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ?
6 Answers
Open up Wireshark, select your .cap file, and then go to File->Export and choose the options that you want.
So, if you need to do it from the command line, use tshark.exe, as follows.
>tshark -i - < "c:\filename.cap" > "c:\output.txt
If you want to write the decoded form of packets to a file, run TShark without the -w option, and redirect its standard output to the file (do not use the -w option).
-
-
@David - none of those are human-readable, they're all meant for use with other traffic analyzers. "Export" is the one that gets you friendly text files, or structured things like PS, CSV, etc.– mfinniJun 10, 2010 at 17:02
-
am sorry I forgot to mention . I want to convert it using some command line ?– VidyaJun 10, 2010 at 17:31
-
OK, edited my answer to include command-line options. @Davey, below, also posted a good answer using an additional tool you may or may not have, tcpdump.– mfinniJun 10, 2010 at 19:40
The -A option of tcpdump
prints each packet in human readable ASCII and happily deals with wireshark files and you can do it all from the command line:
tcpdump -A -r stackoverflow.cap > stackoverflow.txt
The output looks like:
9:22:33.664874 IP 192.168.1.11.33874 > stackoverflow.com.www: Flags [P.], seq 1117095075:1117095829, ack 3371415182, win 9648, options [nop,nop,TS val 9533909 ecr 313735664], length 754
E..&..@.@../....E;...R.PB.........%........
..y...9.GET / HTTP/1.1
Host: serverfault.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-141773580-1259521886021; __utmz=81883924.1275328201.133.5.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=hudson%20build%20dir; usr=t=kXSBoIG5Jk6S&s=wGmaIuhAD0eH; __utma=81883924.2034104685.1272993451.1276186265.1276193655.189; __utmc=81883924; __utmb=81883924.6.10.1276193655
If-Modified-Since: Thu, 10 Jun 2010 10:17:12 GMT
-
Assuming he's running on Unix. Or running WinDump or other Windows clone of TCPDump. Since the guy mentioned Wireshark, I limited my answer to the tools included in the Wireshark package.– mfinniJun 10, 2010 at 18:32
I use the tshark -x -r file.pcap
command line when hexdump like output is good for post processing.
Aren't you able to open wireshark and open that .cap file, then export it from the file menu as a text file? Trying to remember off the top of my head but I thought you could...
-
am sorry I forgot to mention . I want to convert it using some command line ?– VidyaJun 10, 2010 at 17:31
You didn't say exact type of text format, so just wanted to mention other solutions I came across, while looking up this topic:
tshark -V -r file_to_convert.pcap
or
tshark -F k12text -r file_to_convert.pcap
found from
https://stackoverflow.com/questions/68410188/how-to-save-pcap-file-to-text-file-using-tshark
https://codeghar.wordpress.com/2009/07/21/convert-pcap-file-to-text/#comments
For me personally, I don't think I always want a hexdump when I want text.