How to convert multiple .pcap files to .csv

Question

Hi,

I would like to know if it is possible to convert multiple wireshark capture files to csv files. For example there are 3 files in a folder, is there any way to convert all three with a command or does anyone know a way to do this? Any help is appreciated.

I am using a tshark command to convert one file at a time,instead of test.pcap and test.csv i tried using variables as well with wildcard characters.

tshark -T fields -n -r "C:\test.pcap" -E separator=, -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.port -e tcp.analysis.ack_rtt >> "C:\test.csv"

I've also tried using a for command but im running into errors with syntax. This is the full script im working with.

set outfile=*.csv
set infile=*.pcap
cd C:\Program Files\Wireshark
for /f  %%f in ('dir /b C:\testfolder&#39;) do tshark -T fields -n -r "C:\testfolder%infile%" -E separator=, -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.port -e tcp.analysis.ack_rtt >> "C:\testfolder%outfile%"  %%f

Thank you in advance.

Accepted Answer

Please try this:

@echo off
set cap_files="*.cap"
set cap_folder="c:\testfolder&quot;
set outfile=c:\testfolder\outfile.txt
set tshark_cmd="c:\Program Files\Wireshark\tshark"
set tshark_options=-n -T fields -E separator=, -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.port -e tcp.analysis.ack_rtt
echo. > %outfile%
for /r %cap_folder% %%f in (%cap_files%) do (
echo Processing File: %%f
REM echo == File:  %%f &gt;&gt; %outfile%
%tshark_cmd%  -r %%f %tshark_options% &gt;&gt; %outfile%

)
echo.
echo Results in: %outfile% … Cheers Kurt

Sample output:

C:\testfolder> loop.cmd Processing File: c:\testfolder\input_1.cap Processing File: c:\testfolder\input_2.cap

Results in: c:\testfolder\outfile.txt … Cheers Kurt

Regards
Kurt