Ask Your Question
0

How can I export all of the packets that are displayed under the conversations selection?

asked 2022-12-06 09:22:26 +0000

bedoceng gravatar image

updated 2022-12-06 17:04:34 +0000

Chuckc gravatar image

For a specific dataset, there is a flow csv that contains 133k rows. for the corresponding pcap file, there are packets that are the ones in the csv file but the packets are displayed under the conversations selection. How can I export all of the packets that are under the conversations (TCP) selection into a newer pcap file. Thanks.

Basically how can I export all TCP conversations into another pcap?

edit retag flag offensive close merge delete

Comments

Is it "packets" or "packages"?

Chuckc gravatar imageChuckc ( 2022-12-06 15:24:18 +0000 )edit

sorry for the misspelling, packets.

bedoceng gravatar imagebedoceng ( 2022-12-06 16:20:10 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-12-07 02:45:44 +0000

Chuckc gravatar image

Packets that are part of a TCP conversation with have a tcp.stream field.

Set a display filter of tcp.stream then File->Export Specified Packets..., select All packets -> Displayed.

edit flag offensive delete link more
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2022-12-06 09:22:26 +0000

Seen: 456 times

Last updated: Dec 07 '22

Related questions

Tshark TCP stream assembly

Analyze conversation without capturing data

displayed packets counter differs between bottom right corner and "File -> Export Specified Packets"

Does the LUA dissector API support conversation analysis?

Save packet data as hex string

Export capture file

How can I export my hexdump to a file that contains the data in a binary format?

Export capture log (inc. packet data) in a computer-friendly format

displayed packets unmatched when trying to export

How can I export UDP payload without using the slow Follow UDP Stream method