Ask Your Question

How to convert TCP flows in .pcap file to .csv file

asked 2022-03-05 06:48:06 +0000

Rob99 gravatar image

With the command:

tshark -r <file.pcap> -q -z conv,tcp > tcp.conv

I can take the TCP flows in a .pcap file and convert it to a .conv file. However, I am trying to automate capture analysis and this format makes it rather inconvenient for me. Is there a way to convert flows like above into a .csv file instead such that the values are separated by a common delimiter?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-03-05 18:06:05 +0000

Chuckc gravatar image

updated 2022-03-05 18:06:30 +0000

Here's the answer from the old Q&A site:
How to Export the pcap file statistics with csv file format.

4 If you need the data in CSV format, there are (at least) these options:

Use the GUI: Statistics -> Conversations -> TCP -> Copy. This will copy the screen content as CSV into the clipboard.

Use tshark: tshark will not export the conversation data in CSV format, so you either convert it to CSV with Excel (while importing the data) or use a script (perl, python, watherver) to convert that output to csv.

Extend the tshark code to export CSV structured data.

And the open issue asking to add it : 10759 - Tshark -z io,stat options export to csv format

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-03-05 06:48:06 +0000

Seen: 1,655 times

Last updated: Mar 05 '22