15

How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ?

6 Answers 6

12

Open up Wireshark, select your .cap file, and then go to File->Export and choose the options that you want.

So, if you need to do it from the command line, use tshark.exe, as follows.

>tshark -i - < "c:\filename.cap" > "c:\output.txt

If you want to write the decoded form of packets to a file, run TShark without the -w option, and redirect its standard output to the file (do not use the -w option).

4
  • File->Save As also has numerous formats.
    – David
    Jun 10, 2010 at 16:58
  • @David - none of those are human-readable, they're all meant for use with other traffic analyzers. "Export" is the one that gets you friendly text files, or structured things like PS, CSV, etc.
    – mfinni
    Jun 10, 2010 at 17:02
  • am sorry I forgot to mention . I want to convert it using some command line ?
    – Vidya
    Jun 10, 2010 at 17:31
  • OK, edited my answer to include command-line options. @Davey, below, also posted a good answer using an additional tool you may or may not have, tcpdump.
    – mfinni
    Jun 10, 2010 at 19:40
11

The -A option of tcpdump prints each packet in human readable ASCII and happily deals with wireshark files and you can do it all from the command line:

tcpdump -A -r stackoverflow.cap > stackoverflow.txt

The output looks like:

9:22:33.664874 IP 192.168.1.11.33874 > stackoverflow.com.www: Flags [P.], seq 1117095075:1117095829, ack 3371415182, win 9648, options [nop,nop,TS val 9533909 ecr 313735664], length 754
E..&..@.@../....E;...R.PB.........%........
..y...9.GET / HTTP/1.1
Host: serverfault.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-141773580-1259521886021; __utmz=81883924.1275328201.133.5.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=hudson%20build%20dir; usr=t=kXSBoIG5Jk6S&s=wGmaIuhAD0eH; __utma=81883924.2034104685.1272993451.1276186265.1276193655.189; __utmc=81883924; __utmb=81883924.6.10.1276193655
If-Modified-Since: Thu, 10 Jun 2010 10:17:12 GMT
1
  • Assuming he's running on Unix. Or running WinDump or other Windows clone of TCPDump. Since the guy mentioned Wireshark, I limited my answer to the tools included in the Wireshark package.
    – mfinni
    Jun 10, 2010 at 18:32
3

I use the tshark -x -r file.pcap command line when hexdump like output is good for post processing.

2

tshark -x -r "c:\result.pcap" > "c:\final.txt"

That's it. :)

0

Aren't you able to open wireshark and open that .cap file, then export it from the file menu as a text file? Trying to remember off the top of my head but I thought you could...

1
  • am sorry I forgot to mention . I want to convert it using some command line ?
    – Vidya
    Jun 10, 2010 at 17:31
0

You didn't say exact type of text format, so just wanted to mention other solutions I came across, while looking up this topic:

tshark -V -r file_to_convert.pcap

or

tshark -F k12text -r file_to_convert.pcap

found from

https://stackoverflow.com/questions/68410188/how-to-save-pcap-file-to-text-file-using-tshark

https://codeghar.wordpress.com/2009/07/21/convert-pcap-file-to-text/#comments

For me personally, I don't think I always want a hexdump when I want text.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .