This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP information in a text file?

1	I want to feed the nice table that Statistics->Conversation List-->TCP makes to a script. How to dump that table in a file? statistics conversationlist tcp asked 28 Jul '12, 16:14 oscarmeyer 16●1●1●2 accept rate: 0%

2 Answers:

There is "Copy" button next at the bottom left in the same window. Click on Copy and paste it to a text file, then save it as CSV file. Open it with a program like Excel or Calc. Now you can do whatever you want from there.

answered 28 Jul '12, 19:10

ntwkeng
21●1●1●4
accept rate: 0%

Thanks. I meant how to generate that table from the tshark command line and dump it to a file.

(29 Jul '12, 11:50) oscarmeyer

You can use the statistics functions of tshark

tshark -r input.cap.pcapng -q -z conv,ip > output.txt
tshark -r input.cap.pcapng -q -z conv,tcp > output.txt
tshark -r input.cap.pcapng -q -z conv,udp > output.txt

Regards
Kurt

answered 29 Jul '12, 01:13

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Saw that, but that only gives a few of the columns. I need the others too, like duration and relative start time.

(29 Jul '12, 11:51) oscarmeyer

I need the others too, like duration and relative start time.

That's in the output. Last two cloumns for -z conv,tcp. Actually it's the same output as in the GUI, with a slightly different formatting. Only bps (bits/s) is missing.

(29 Jul '12, 11:59) Kurt Knochner ♦

Not for me. What version are you using?

(29 Jul '12, 12:49) oscarmeyer

TShark 1.8.1 (SVN Rev 43946 from /trunk-1.8)

(29 Jul '12, 14:06) Kurt Knochner ♦

I was one version behind. The latest has the info. Thank you!

(29 Jul '12, 16:24) oscarmeyer

Somewhere between 1.8 and 1.10 they dropped the -q option in wireshark and so now you want the same arguments but the tshark executable

(29 Jul '16, 13:45) huckle

The -q option is still there. See the latest online tshark man page.

(29 Jul '16, 19:01) cmaynard ♦♦

showing 5 of 7 show 2 more comments