TCP information in a text file?

1	I want to feed the nice table that Statistics->Conversation List-->TCP makes to a script. How to dump that table in a file? statistics conversationlist tcp asked 28 Jul '12, 16:14 oscarmeyer 16●1●1●2 accept rate: 0%

2 Answers:

active answers oldest answers newest answers popular answers

There is "Copy" button next at the bottom left in the same window. Click on Copy and paste it to a text file, then save it as CSV file. Open it with a program like Excel or Calc. Now you can do whatever you want from there.

permanent link

answered 28 Jul '12, 19:10

ntwkeng
21●1●1●4
accept rate: 0%

Thanks. I meant how to generate that table from the tshark command line and dump it to a file.

(29 Jul '12, 11:50) oscarmeyer

You can use the statistics functions of tshark

tshark -r input.cap.pcapng -q -z conv,ip > output.txt
tshark -r input.cap.pcapng -q -z conv,tcp > output.txt
tshark -r input.cap.pcapng -q -z conv,udp > output.txt

Regards
Kurt

permanent link

answered 29 Jul '12, 01:13

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Saw that, but that only gives a few of the columns. I need the others too, like duration and relative start time.

(29 Jul '12, 11:51) oscarmeyer

I need the others too, like duration and relative start time.

That's in the output. Last two cloumns for -z conv,tcp. Actually it's the same output as in the GUI, with a slightly different formatting. Only bps (bits/s) is missing.

(29 Jul '12, 11:59) Kurt Knochner ♦

Not for me. What version are you using?

(29 Jul '12, 12:49) oscarmeyer

TShark 1.8.1 (SVN Rev 43946 from /trunk-1.8)

(29 Jul '12, 14:06) Kurt Knochner ♦

I was one version behind. The latest has the info. Thank you!

(29 Jul '12, 16:24) oscarmeyer

Somewhere between 1.8 and 1.10 they dropped the -q option in wireshark and so now you want the same arguments but the tshark executable

(29 Jul '16, 13:45) huckle

The -q option is still there. See the latest online tshark man page.

(29 Jul '16, 19:01) cmaynard ♦♦

showing 5 of 7 show 2 more comments

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

tcp ×752
statistics ×86
conversationlist ×4

question asked: 28 Jul '12, 16:14

question was seen: 14,737 times

last updated: 29 Jul '16, 19:01

How to get Statistics->Conversation List-->TCP information in a text file?

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions