Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

If you mean "Info Column", and that's the only column you want, you can achieve this with tshark:

Method 1: Specify the column format explicitly:

*nix: tshark -r file.pcap -o 'gui.column.format:"Info","%i"' > info.txt
Windows: tshark -r file.pcap -o "gui.column.format:\"Info\",\"%i\"'" > info.txt

Run tshark -G column-formats for a list of "built-in" column formats. If a field isn't listed, then you can always use the "Some Field","%Cus:someproto.somefield" method for adding so-called custom columns.

Method 1: Specify the fields you want: tshark -r file.pcap -T fields -e _ws.col.Info > info.txt

Of course you can also achieve this with Wireshark as well, but if you use File -> Export Packet Dissections -> As Plain Text... without preparing the column layout first, then you'll be exporting all columns, and not just the Info column.