This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Transforming a .pcap file to a CSV file on windows 7 using tshark

0

I'm having 184MB size PCAP file in this location C:\Program Files\Wireshark\pcap3.pcap

I wanted to convert my pcap file into CSV file with some requirement field to analyze network traffic data. Firstly I change my CMD path to "C:\Program Files\Wireshark" to run my tshark command. After that, I checked my files in that wireshark folder by typing this command "dir pcap3.pcap". Then I run this command to break certain column which I wanted " tshark -r testfile.pcap -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto -E header=y -E separator=, -E quote=d -E occurrence=f ". This command take about 30 minute to complete. Finally i wanted to convert this pcap file into CSV i used this command " tshark -r testfile.pcap -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto -E header=y -E separator=, -E quote=d -E occurrence=f > pcap3.csv ". When I run the last command it show access denied. Can i know how to solve this things.

This question is marked "community wiki".

asked 17 Nov '14, 11:28

Winash's gravatar image

Winash
11112
accept rate: 0%

wikified 17 Nov '14, 11:30


One Answer:

0

It would appear that you don't have permission to write to the C:\Program Files\Wireshark\ directory. And it's probably not the best location for writing user files anyway. Try specifying an alternate destination, e.g., tshark -r testfile.pcap -T fields ... > C:\Users\Winash\Documents\pcap3.csv.

You might also want to try adding C:\Program Files\Wireshark\ to your PATH environment variable to make it easier to run tshark without having to either specify the full path each time you run it or to change to the C:\Program Files\Wireshark\ directory as you seem to be doing now.

answered 17 Nov '14, 12:00

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

An alternative to adding the Wireshark directory to PATH, is to use PowerShell and add an alias, e.g.

New-Alias ts 'C:\Program Files\Wireshark\tshark.exe'

and then use ts as the command.

(17 Nov '14, 13:35) grahamb ♦

Thank you. I have done with the conversion of data. It's really worked

(17 Nov '14, 21:27) Winash

Your "answer" has been converted to a comment as that's how this site works. Please read the FAQ for more information.

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(17 Nov '14, 23:37) grahamb ♦