How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ?

Regards, Mithun


Open up Wireshark, select your .cap file, and then go to File->Export and choose the options that you want.

So, if you need to do it from the command line, use tshark.exe, as follows.

>tshark -i - < "c:\filename.cap" > "c:\output.txt

If you want to write the decoded form of packets to a file, run TShark without the -w option, and redirect its standard output to the file (do not use the -w option).

  • File->Save As also has numerous formats. – David Jun 10 '10 at 16:58
  • @David - none of those are human-readable, they're all meant for use with other traffic analyzers. "Export" is the one that gets you friendly text files, or structured things like PS, CSV, etc. – mfinni Jun 10 '10 at 17:02
  • am sorry I forgot to mention . I want to convert it using some command line ? – Vidya Jun 10 '10 at 17:31
  • OK, edited my answer to include command-line options. @Davey, below, also posted a good answer using an additional tool you may or may not have, tcpdump. – mfinni Jun 10 '10 at 19:40

The -A option of tcpdump prints each packet in human readable ASCII and happily deals with wireshark files and you can do it all from the command line:

tcpdump -A -r stackoverflow.cap > stackoverflow.txt

The output looks like:

9:22:33.664874 IP > stackoverflow.com.www: Flags [P.], seq 1117095075:1117095829, ack 3371415182, win 9648, options [nop,nop,TS val 9533909 ecr 313735664], length 754
..y...9.GET / HTTP/1.1
Host: serverfault.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __qca=P0-141773580-1259521886021; __utmz=81883924.1275328201.133.5.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=hudson%20build%20dir; usr=t=kXSBoIG5Jk6S&s=wGmaIuhAD0eH; __utma=81883924.2034104685.1272993451.1276186265.1276193655.189; __utmc=81883924; __utmb=81883924.6.10.1276193655
If-Modified-Since: Thu, 10 Jun 2010 10:17:12 GMT
  • Assuming he's running on Unix. Or running WinDump or other Windows clone of TCPDump. Since the guy mentioned Wireshark, I limited my answer to the tools included in the Wireshark package. – mfinni Jun 10 '10 at 18:32

I use the tshark -x -r file.pcap command line when hexdump like output is good for post processing.


Aren't you able to open wireshark and open that .cap file, then export it from the file menu as a text file? Trying to remember off the top of my head but I thought you could...

  • am sorry I forgot to mention . I want to convert it using some command line ? – Vidya Jun 10 '10 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.