How do I get the default output of TShark as a CSV?

Question

I am not sure where i need to go to find the answer to my question. So if there is a link i missed please let me know. I dont mind trying to figure it out. But will gladly accept an answer too.

I am trying to save the output of this command to a CSV file preferably. saving straight to the csv is ideal as opening a pcap file and converting regularly does not sound fun either.

The command i am trying to replicate is:

tshark -i wlan1 subtype probereq

I have tried using command tshark -i wlan1 subtype probereq -V >testout.txt

Accepted Answer

0

I assume from

The command i am trying to replicate is:

tshark -i wlan1 subtype probereq

that you want the columns that tshark -i wlan1 subtype probereq prints out to be written to a file as a CSV, i.e. with commas between the column values.

There's not a simple way to do that directly, but you can ask TShark to print various values from the packet with commas between them. If you want the standard set of columns, you could, at least with newer versions of Wireshark, do

tshark -i wlan1 -T fields -E separator=, -E quote=d -e _ws.col.No. -e _ws.col.Time -e _ws.col.Source -e _ws.col.Destination -e _ws.col.Protocol -e _ws.col.Length -e _ws.col.Info subtype probereq

permanent link

answered 09 Jan '16, 20:59

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

edited 10 Jan '16, 00:40

Thank you for the help. This is getting the results i am looking for. But now the issue is writing those results to a file.

When i add -w testfile.txt it just prints to screen but nothing in the file. same with -w -v >testfile.txt

Any advise on writing the results to a capture file?

(13 Jan '16, 21:50) thegeneral

-w specifies to what file the raw captured data should be written. It is always an error to use -w with a file whose name ends in .txt, because TShark (and dumpcap, and tcpdump) do not write out raw captures as text.

If you don't need the raw packet file (to read later with Wireshark or tcpdump or some other program that can read pcap or pcapng files), then don't specify -w at all, just run tshark with the output redirected to the file, and no -w:

tshark -i wlan1 -T fields -E separator=, -E quote=d -e _ws.col.No. -e _ws.col.Time -e _ws.col.Source -e _ws.col.Destination -e _ws.col.Protocol -e _ws.col.Length -e _ws.col.Info subtype probereq >testfile.txt

(13 Jan '16, 21:54) Guy Harris ♦♦

How do I get the default output of TShark as a CSV?

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions