How can I parse or convert a .pcapng file?

asked 2019-02-07 08:32:40 +0000

testFJ gravatar image

I want to get all the information of the packets in a .pcapng file.

edit retag flag offensive close merge delete

Comments

Can you be more specific? The pcapng format is described e.g here, but if you are interested in access to more than timestamps and raw packet bytes, you should use tshark which dissects the packets like Wireshark does.

sindy gravatar imagesindy ( 2019-02-07 10:13:35 +0000 )edit

what download link for tshark for win32 ?

BTW https://pcapng.github.io/pcapng/#rfc.... PCAP Next Generation (pcapng) Capture File Format

this draft expired on March 6, 2016

"Network Working Group
Intended status: Informational
Expires: March 6, 2016

darius gravatar imagedarius ( 2019-02-07 12:40:31 +0000 )edit

Take a look here for the spec. And here you'll find the download

Jaap gravatar imageJaap ( 2019-02-07 12:49:16 +0000 )edit

thank you for the link to the latest internet draft of the PCAP Next Generation (pcapng) Capture File Format

I meant tshark vs. Wireshark download link https://www.wireshark.org/docs/man-pa... as you said: "tshark which dissects the packets like Wireshark does

from https://www.wireshark.org/docs/man-pa... "TShark is part of the Wireshark distribution

from https://osqa-ask.wireshark.org/questi...

TShark for Windows "

Tshark is part of the Wireshark installer that can be downloaded here. During the installation, you can choose to install tshark (actvated by default) and once completed, you will find it in your installation folder. permanent link

answered 10 May '17, 00:18 Pascal%20Quantin's gravatar image

Pascal Quantin 5.5k●10●60 accept rate: 30%

Note that the Wireshark installer does NOT add the Wireshark binary directory to the path.

To use tshark.exe you can:

Type the full path every time ...
(more)
darius gravatar imagedarius ( 2019-02-07 16:07:39 +0000 )edit

What are you trying to convert the .pcapng file to? If you're only looking to convert it to a .pcap file, you can do that easily with editcap. For example:

editcap -F pcap infile.pcapng outfile.pcap

Is there some other use case that you have where the tools available with Wireshark don't meet your needs?

cmaynard gravatar imagecmaynard ( 2019-02-07 16:37:27 +0000 )edit