Ask Your Question
0

Command line tshark JSON and Packet details all expanded

asked 2019-11-06 15:53:35 +0000

BAW331 gravatar image

Hi there,

I would like to convert PCAP files to JSON using the tshark command line and they must have Packet details: All expanded using the command line without the pack summary line option selected.

So summary(using the command line save PCAP as): - Export to JSON - Packet details: All expanded - Packet summary line: unticked

Is there anyway to do that?

Thanks for your help!!!

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-11-06 16:17:51 +0000

bubbasnmp gravatar image

updated 2019-11-06 16:22:37 +0000

Have you tried:

tshark -r "filename" -T json
edit flag offensive delete link more

Comments

https://www.wireshark.org/docs/man-pa... json JSON file format. It can be used with -j or -J including the JSON filter or with -x option to include raw hex-encoded packet data. Example of usage:

  tshark -T json -r file.pcap
  tshark -T json -j "http tcp ip" -x -r file.pcap
bubbasnmp gravatar imagebubbasnmp ( 2019-11-06 16:22:01 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-11-06 15:53:35 +0000

Seen: 34 times

Last updated: Nov 06