This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

The File menu option "Export Selected Packet Bytes..." is NOT enabled. What do I need to do to enable it?

asked 11 Feb '14, 06:31

bundgaj's gravatar image

bundgaj
1111
accept rate: 0%

edited 11 Feb '14, 07:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237

This problem exists in both 1.10.5 and 1.11.2

(11 Feb '14, 06:32) bundgaj

From the manual: http://www.wireshark.org/docs/wsug_html_chunked/ChIOExportSection.html

5.7.7. The "Export selected packet bytes" dialog box
Export the bytes selected in the "Packet Bytes" pane into a raw binary file. 

As soon as you select some bytes in the 'Packet Bytes' pane, the menu item will be enabled.

Regards
Kurt

permanent link

answered 11 Feb '14, 06:41

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Thanks. What I really want to do is to export only the headers from the pcap file. How do I do that?

(11 Feb '14, 06:56) bundgaj

It depends on what you mean by "headers from the pcap file"...

I guess the following should be O.K. for you.

File -> Export Packet Dissections -> as plain text file

Then take a look at the "Packet Format" option.

Additionally, you can use tshark to extract whatever 'protocol field' you need.

tshark -nr input.pcap -T fields -e frame.number -e ip.src -e ip.dst -e tcp.port -e xxxxx

See the Display filter reference for all available fields.

(11 Feb '14, 07:01) Kurt Knochner ♦

The pcap file has a variety of encapsulations: UDP, TCP, L3 only... I'd like to export the entire pcap file without any of the 'payload data'.

(11 Feb '14, 07:06) bundgaj

In what form do you want to export it? Do need a new pcap file, just without the payload (like for anonymization) or do you need a text representation of the dissected headers, just without the payload?

(11 Feb '14, 07:13) Kurt Knochner ♦

A new pcap file.

(11 Feb '14, 07:20) bundgaj

Ah, then you need a tool to anonymize the file.

One of the best tools available is TraceWrangler from @Jasper.

There are other tools as well, just google for: 'pcap anonymizer' or 'pcap anonymization'

You can also use editcap to cut off the frames at a certain position.

editcap -C 100 input.pcap output.pcap

(11 Feb '14, 07:21) Kurt Knochner ♦
showing 5 of 6 show 1 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×248
×76
×32
×5
×2

question asked: 11 Feb '14, 06:31

question was seen: 13,683 times

last updated: 11 Feb '14, 07:39

p​o​w​e​r​e​d by O​S​Q​A