Ask Your Question
0

save info field from "screen" to a file

asked 2020-05-21 16:11:57 +0000

Russ gravatar image

How do you save the info field to a text file for every packet that was filtered by the capture filter.

edit retag flag offensive close merge delete

Comments

Filtered by a Display Filter?
Export Packet Dissections
If on Windows verify that you're on latest 3.2.4 release.

Chuckc gravatar imageChuckc ( 2020-05-21 16:23:59 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted
0

answered 2020-05-21 16:32:03 +0000

Russ gravatar image

Use File / Export Packet Dissections / As Plain Text / Clear Packet Details checkbox

edit flag offensive delete link more
0

answered 2020-05-21 17:16:41 +0000

cmaynard gravatar image

If you mean "Info Column", and that's the only column you want, you can achieve this with tshark:

Method 1: Specify the column format explicitly:

*nix: tshark -r file.pcap -o 'gui.column.format:"Info","%i"' > info.txt
Windows: tshark -r file.pcap -o "gui.column.format:\"Info\",\"%i\"'" > info.txt

Run tshark -G column-formats for a list of "built-in" column formats. If a field isn't listed, then you can always use the "Some Field","%Cus:someproto.somefield" method for adding so-called custom columns.

Method 1: Specify the fields you want: tshark -r file.pcap -T fields -e _ws.col.Info > info.txt

Of course you can also achieve this with Wireshark as well, but if you use File -> Export Packet Dissections -> As Plain Text... without preparing the column layout first, then you'll be exporting all columns, and not just the Info column.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-05-21 16:11:57 +0000

Seen: 492 times

Last updated: May 21 '20