This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have managed to get a reasonable specific capture filter working and now I need to get some very specific information out of the results.

My Capture filter limits the traffic to a specific TCP port.

How can I write out to something like a CSV file, just the following 2 fields (although they are from different data levels):

  • Arrival Time from Frame
  • Source from Internet Protocol Version 4

Thanks in anticipation.

Alan

asked 15 Oct '14, 20:22

Alan%20Eth's gravatar image

Alan Eth
6223
accept rate: 0%


Using tshark, have a look at the -T fields and -e fieldname options, i.e.-T fields -e frame.time -e ip.src. The field names for the -e options are display filter field names which can be easily determined using Wireshark by inspecting the field in the packet details display and looking at the field info at the bottom left of the status bar where the filter name is in parentheses.

If you want to do this using Wireshark, you will have to arrange that only the required columns are on display, then from the menu select File | Export Packet Dissections | As CSV, and in the options dialog uncheck "Packet details".

permanent link

answered 16 Oct '14, 06:09

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×22

question asked: 15 Oct '14, 20:22

question was seen: 2,931 times

last updated: 16 Oct '14, 06:09

p​o​w​e​r​e​d by O​S​Q​A