This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I want to feed the nice table that Statistics->Conversation List-->TCP makes to a script. How to dump that table in a file?

asked 28 Jul '12, 16:14

oscarmeyer's gravatar image

oscarmeyer
16112
accept rate: 0%


There is "Copy" button next at the bottom left in the same window. Click on Copy and paste it to a text file, then save it as CSV file. Open it with a program like Excel or Calc. Now you can do whatever you want from there.

permanent link

answered 28 Jul '12, 19:10

ntwkeng's gravatar image

ntwkeng
21114
accept rate: 0%

Thanks. I meant how to generate that table from the tshark command line and dump it to a file.

(29 Jul '12, 11:50) oscarmeyer

You can use the statistics functions of tshark

tshark -r input.cap.pcapng -q -z conv,ip > output.txt
tshark -r input.cap.pcapng -q -z conv,tcp > output.txt
tshark -r input.cap.pcapng -q -z conv,udp > output.txt

Regards
Kurt

permanent link

answered 29 Jul '12, 01:13

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Saw that, but that only gives a few of the columns. I need the others too, like duration and relative start time.

(29 Jul '12, 11:51) oscarmeyer

I need the others too, like duration and relative start time.

That's in the output. Last two cloumns for -z conv,tcp. Actually it's the same output as in the GUI, with a slightly different formatting. Only bps (bits/s) is missing.

(29 Jul '12, 11:59) Kurt Knochner ♦

Not for me. What version are you using?

(29 Jul '12, 12:49) oscarmeyer

TShark 1.8.1 (SVN Rev 43946 from /trunk-1.8)

(29 Jul '12, 14:06) Kurt Knochner ♦

I was one version behind. The latest has the info. Thank you!

(29 Jul '12, 16:24) oscarmeyer

Somewhere between 1.8 and 1.10 they dropped the -q option in wireshark and so now you want the same arguments but the tshark executable

(29 Jul '16, 13:45) huckle

The -q option is still there. See the latest online tshark man page.

(29 Jul '16, 19:01) cmaynard ♦♦
showing 5 of 7 show 2 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×86
×4

question asked: 28 Jul '12, 16:14

question was seen: 14,186 times

last updated: 29 Jul '16, 19:01

p​o​w​e​r​e​d by O​S​Q​A