Hi guys.

Maybe there is a method, to save or convert wireshark capture file directly to txt?

For example, to get the same output into txt file, as we can see, when we press the button "Follow tcp stream" ?

asked 26 Jun '12, 07:24

jomajo's gravatar image

jomajo
1335
accept rate: 100%


You can use tshark (Version >= 1.7) for that:

tshark -r input.cap -R "tcp.stream eq 1" -z follow,tcp,ascii,1

The number is the TCP stream number.

UPDATE: You can also try the tshark option -V (all protocol fields "expanded" --> a lot of output").

tshark -r input.cap -V "tcp.stream eq 1"

You can combine both options (-V and -z).

Regards
Kurt

link

answered 26 Jun '12, 07:44

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
18.9k733181
accept rate: 15%

edited 26 Jun '12, 08:13

We can save the capture without opening .cap file at all?

(26 Jun '12, 07:59) jomajo

I'm not sure what you mean by "save the capture without opening .cap file".

tshark expects an input file which it opens to extract the data.

Maybe you can tell me a bit more .....

(26 Jun '12, 08:01) Kurt Knochner ♦

:)

I am capturing some data. Next day, when I come to check the data, I see few .txt files generated, and when I open these, I can see just tcp stream data ( as you said, ascii characters).

It would be nice , if it is possible?

(26 Jun '12, 09:18) jomajo

Ah, you want to do it on the fly, without saving the captured data. No, that is not possible with Wireshark or tshark.

Take a look at tcpflow (Unix tool)

BTW: There is a similar question

(26 Jun '12, 17:02) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×376
×330
×44

Asked: 26 Jun '12, 07:24

Seen: 3,079 times

Last updated: 26 Jun '12, 17:03

powered by OSQA