Is there a way to programatically export files using Wireshark's facilities?

wireshark pcap
Uri picture Uri · Mar 9, 2010 · Viewed 7.2k times · Source

I am trying to automate a repetitive manual process for which I use WireShark:

1) Load a given pcap file

2) Apply a simple filter for a given protocol

3) Use the export dialog box to export the displayed packets to CSV file

4) Use the export dialog box to export the displayed packets in XML PDML form.

This is tedious, and requires human involvement in the middle of a process that is mostly automated (including the analysis of the files to produce reports).

Is there some way to either automate Wireshark, or do somehow access the underlying libraries used for export?

UPDATE: As several people here indicated, TShark turns out to be the way to go. The exact command line I ended up using is:

tshark -r MyDataFile.pcap -T pdml -R MyProtocol > MyOutputFile.xml\

I then use an event based XML parser (Python's expat) to parse the generated 2GB file

Answer

Dacav picture Dacav · Mar 9, 2010

I watched at the dependency list of wireshark on my debian system, and I found Tshark: it's the command line version of wireshark.

It seems interesting, but I didn't read the manual yet, however it's for sure more script friendly.

Also I'll stay tuned on this thread and post more info when I'll start using it.

Related questions

How to filter MAC addresses using tcpdump?

I am running tcpdump on DD-WRT routers in order to capture uplink data from mobile phones. I would like to listen only to some mac addresses. To do this I tried to run the command using a syntax similar to …

Read More
set a filter of packet length in wireshark

I've capture a pcap file and display it on wireshark. I want to analysis those udp packets with 'Length' column equals to 443. On wireshark, I try to found what's the proper filter. udp && length 443 # invalid usage udp &&…

Read More
Export pcap data to csv: timestamp, bytes, uplink/downlink, extra info

I was wondering if there is any tool that can parse pcap data and convert it to a csv file with the following information: timestamp, bytes, uplink/downlink, some extra info.. Basically, the uplink/downlink could be seen by the …

Read More