Ask Your Question
0

How can I export all of the packets that are displayed under the conversations selection?

asked 2022-12-06 09:22:26 +0000

bedoceng gravatar image

updated 2022-12-06 17:04:34 +0000

Chuckc gravatar image

For a specific dataset, there is a flow csv that contains 133k rows. for the corresponding pcap file, there are packets that are the ones in the csv file but the packets are displayed under the conversations selection. How can I export all of the packets that are under the conversations (TCP) selection into a newer pcap file. Thanks.

Basically how can I export all TCP conversations into another pcap?

edit retag flag offensive close merge delete

Comments

Is it "packets" or "packages"?

Chuckc gravatar imageChuckc ( 2022-12-06 15:24:18 +0000 )edit

sorry for the misspelling, packets.

bedoceng gravatar imagebedoceng ( 2022-12-06 16:20:10 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-12-07 02:45:44 +0000

Chuckc gravatar image

Packets that are part of a TCP conversation with have a tcp.stream field.

Set a display filter of tcp.stream then File->Export Specified Packets..., select All packets -> Displayed.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-12-06 09:22:26 +0000

Seen: 114 times

Last updated: Dec 07 '22