How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ?
Open up Wireshark, select your .cap file, and then go to File->Export and choose the options that you want.
So, if you need to do it from the command line, use tshark.exe, as follows.
>tshark -i - < "c:\filename.cap" > "c:\output.txt
If you want to write the decoded form of packets to a file, run TShark without the -w option, and redirect its standard output to the file (do not use the -w option).
The -A option of tcpdump prints each packet in human readable ASCII and happily deals with wireshark files and you can do it all from the command line:
tcpdump -A -r stackoverflow.cap > stackoverflow.txt
The output looks like:
9:22:33.664874 IP 192.168.1.11.33874 > stackoverflow.com.www: Flags [P.], seq 1117095075:1117095829, ack 3371415182, win 9648, options [nop,nop,TS val 9533909 ecr 313735664], length 754 E..&..@.@../....E;...R.PB.........%........ ..y...9.GET / HTTP/1.1 Host: serverfault.com Connection: keep-alive User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __qca=P0-141773580-1259521886021; __utmz=81883924.1275328201.133.5.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=hudson%20build%20dir; usr=t=kXSBoIG5Jk6S&s=wGmaIuhAD0eH; __utma=81883924.2034104685.1272993451.1276186265.1276193655.189; __utmc=81883924; __utmb=818839188.8.131.526193655 If-Modified-Since: Thu, 10 Jun 2010 10:17:12 GMT
I use the
tshark -x -r file.pcap command line when hexdump like output is good for post processing.
Aren't you able to open wireshark and open that .cap file, then export it from the file menu as a text file? Trying to remember off the top of my head but I thought you could...