Ask Your Question

incomplete export of call flow sequence

asked 2020-11-04 18:53:07 +0000

Michel gravatar image

Hi, The "Save As" in a call-flow export only one page to PDF. It actually do the equivalent of a screen shot of what is actually visible in the windows. Is it possible to export everything, from start to finish, no just what we see at the current position of the scroll bar? I personally would like a way to export all the entries of the "comment" column of the flow sequence to txt/csv...

Thank you

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-11-04 19:04:24 +0000

Chuckc gravatar image

updated 2020-11-04 19:10:21 +0000

Have you tried a "Save As..." with file type set to ASCII (*.txt) ?

You might be able to get what you want with the tshark -z flow,name,mode,[filter] option.

edit flag offensive delete link more


tshark was very handy.

The flow windows have one big quality, and it is that it regroups similar packet (count them and give a duration), that take only one line and cleanup the view... I did not found a similar output with tshark, for a 19500 frame capture, "tshark-z flow,any,standard" keep the same output size, so does "tshark -z sip,stat" and "tshark -z expert,sip"

I end up using tshark to convert everything in json and then handle the data in powershell. (could be faster with one of the above switches and some cleanup using regex but I decide to take the long route and handle all the raw data) I had to check the code of the different dissectors in Wireshark github to match the different ID with what they meant, and it was a somewhat fun experiment.

Michel gravatar imageMichel ( 2020-11-09 21:58:29 +0000 )edit

"Save As..." with file type set to ASCII (*.txt) -> I do not know how I miss that, that works well :)

Michel gravatar imageMichel ( 2020-11-09 22:06:11 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-11-04 18:53:07 +0000

Seen: 36 times

Last updated: Nov 09