This is our old Q&A Site. Please post any new questions and answers at

Hi guys.

Maybe there is a method, to save or convert wireshark capture file directly to txt?

For example, to get the same output into txt file, as we can see, when we press the button "Follow tcp stream" ?

asked 26 Jun '12, 07:24

jomajo's gravatar image

accept rate: 100%

You can use tshark (Version >= 1.7) for that:

tshark -r input.cap -R " eq 1" -z follow,tcp,ascii,1

The number is the TCP stream number.

UPDATE: You can also try the tshark option -V (all protocol fields "expanded" --> a lot of output").

tshark -r input.cap -V " eq 1"

You can combine both options (-V and -z).


permanent link

answered 26 Jun '12, 07:44

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 26 Jun '12, 08:13

We can save the capture without opening .cap file at all?

(26 Jun '12, 07:59) jomajo

I'm not sure what you mean by "save the capture without opening .cap file".

tshark expects an input file which it opens to extract the data.

Maybe you can tell me a bit more .....

(26 Jun '12, 08:01) Kurt Knochner ♦


I am capturing some data. Next day, when I come to check the data, I see few .txt files generated, and when I open these, I can see just tcp stream data ( as you said, ascii characters).

It would be nice , if it is possible?

(26 Jun '12, 09:18) jomajo

Ah, you want to do it on the fly, without saving the captured data. No, that is not possible with Wireshark or tshark.

Take a look at tcpflow (Unix tool)

BTW: There is a similar question

(26 Jun '12, 17:02) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 Jun '12, 07:24

question was seen: 8,259 times

last updated: 26 Jun '12, 17:03

p​o​w​e​r​e​d by O​S​Q​A