menticol's profile - activity

Very good question Chuckc, the problem is that the list of required fields is too long for passing them as console argum

Just an idea! Try this powershell command before running Wireshark, save the result. Repeat after running Wireshark. Di

Flatten a .PCAP file to text (see question for better explanation) Hi guys I have a PCAP file (uploaded it here since I

https://www.wireshark.org/docs/wsug_html_chunked/ChIOExportSection.html

Sorry for taking such a long time to answer you. I gave the thumbs up without thinking twice! For the forum readers, I t

Sorry for taking such a long time to answer you. I gave the thumbs up without thinking twice! For the forum readers, I t

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get whichever field is indicated on the filter.

Instead, I would like to get the whole PCAP contents (plus the-e _ws.col.Info field). In that way the user could navigate through the file in a visual way, and later export whatever field he/she wants.

Let me show you some pictures of how the program looks

Picture1

Picture 2

This is part of the code I came up with, if anybody finds it useful

    String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
    String fileNameWithExtension = Path.GetFileName(pcapFilePath);
    String pathWorkingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

    String pathFilteredPcap = "\"" + pathWorkingFolder + fileNameWithoutExtension + "_filtered.pcap\"";
    String argumentsPcapToFilteredPcap = "-r \"" + pcapFilePath + "\" -Y camel -w " + pathFilteredPcap;

    String consoleOutputPcapToFilteredPcap = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsPcapToFilteredPcap);

    Console.WriteLine(consoleOutputPcapToFilteredPcap);
    Console.WriteLine("Filtered PCAP ready...");

    String pathJsonFile = pathWorkingFolder + fileNameWithoutExtension + ".json";
    String argumentsFilteredPcapToJson = "-r " + pathFilteredPcap + " -T json ";

    Console.WriteLine("Generating JSON...");

    String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsFilteredPcapToJson);

    UtilsIO.saveTextFile(consoleOutputFromPcapToJson, pathJsonFile);

    Console.WriteLine("JSON Ready...");

As always thank you very much!

Sorry for taking such a long time to answer you. I gave the thumbs up without thinking twice! For the forum readers, I t

Thank you as always for your lightning-fast answers @Chuckc. Sadly I did not express my question properly due to my lack

Get ws.col.Info (plus the whole PCAP) as a .json exported file Hi again guys! I'm making a little C# code to export exp

Edited the question's title and added some screenshots to properly explain my problem

Get ws.col.Info as part of .json exported file Hi again guys! I'm making a little C# code to export expanded PCAP files

Hi guys!

I'm working on a little program to convert .PCAP files into MySQL tables, in order to make analysis easier (a program that I will share here as soon as is finished, naturally).

My first command is running on a Windows console and outputs a very nice filtered .pcap file, filled with information.

tshark -r "C:\proyecto \20210729_15_45-MIRR-BKP.pcap" -Y camel -w "C:\proyecto\20210729_15_45-MIRR-BKP_filtered.pcap"

However, on my next step, converting the aforementioned .PCAP to JSON, I'm getting a blank JSON file.

tshark -r "C:\proyecto\20210729_15_45-MIRR-BKP_filtered.pcap" -T json -w "C:\proyecto\20210729_15_45-MIRR-BKP.json"

I used the code provided by @Chuckc on this post.

Once I get the .JSON part working, I'll implement a little UI to select what packet information will be exported, etc.

Thank you and best regards

Get ws.col.Info as part of .json exported file Hi again guys! I'm making a little C# code to export expanded PCAP files

Thank you as always for your lightning-fast answers @Chuckc. Sadly I did not express my question properly due to my lack

Thank you as always for your lightning-fast answers @Chuckc. Sadly did not express my question properly due to my lack o

Get ws.col.Info as part of .json exported file Hi again guys! I'm making a little C# code to export expanded PCAP files

Get ws.col.Info as part of .json exported file Hi again guys! I'm making a little C# code to export expanded PCAP files

Get ws.col.Info as part of .json exported file Hi again guys! I'm making a little C# code to export expanded PCAP files

Get ws.col.Info as part of .json exported file Hi again guys! I'm making a little C# code to export expanded PCAP files

@Chuckc provided the answer to this question in his comment. Quoting him: NOTE: -w provides raw packet data, not t

Get ws.col.Info as part of .json exported file Hi again guys! I'm making a little C# code to export expanded PCAP files

Exporting PCAP to Database Hi guys! I'm working on a little program to convert .PCAP files into MySQL tables, in order

I'm very sorry for taking so long guys. Thank you Bubbasnmp, your solution was much more elegant, but since I'm working

Tshark: Get multiple ocurrences with same field value Hi guys! Presenting this case without being able to upload screen

Tshark: Get multiple ocurrences with same field value Hi guys! Presenting this case without being able to upload screen

Ok I just went ahead and uploaded an external link, if this is not allowed please let me know to take it down

Tshark: Get multiple ocurrences with same field value Hi guys! Presenting this case without being able to upload screen