convert the pcap file to csv in asp.net web application

Question

Hi, I have a pcap file and i am developing a web application from where user will upload a pcap file, then User will click on Process button. Now i want to process that pcap file and want to INSERT/Add all data of pcap file in sql server database.

So how can i do this ? I have tried to INSERT data of pcap file but the data did not added in a readable formate :-(

So now i want to know a method name to whom i will pass that pcap file and it will return a file in csv formate. Then it will be very simple to pass that file to sql server and data will be inserted in database table.

Thanks in advance, i am a newbie over here :-)

Accepted Answer

Following is the command to convert a pCap file to csv format:

tshark -T fields -n -r {the pathname of the capture file} -E separator=, -e {first field name} -e {second field name} ... >{the pathname of the output file}

Where {the pathname of the capture file} is the pathname of the capture file you're reading and {first field name}, {second field name} and so on are the names of the fields, and {the pathname of the output file} is the pathname of the output file.

Here is the final command of TShark to convert pCap file to CSV file format:

tshark -T fields -n -r C:\capture.pcap -E separator=, -e ip.src -e ip.dst >C:\output.csv

Now we have the pCap file in CSV format, it is now possible to Insert/Add this in sql server database table.

Note: tshark = C:\Program Files\Wireshark\tshark.exe

Initiate an object of Process in your c# class and provide the path of cmd and pass above command line that will launch Tshark.exe and run the provided command and give us the output file at C:\output.csv. Now we can pick this file path and do what we want to do with this file like Insert in database table etc...

Answer 2

Note that there are already quite a few existing questions on this site regarding CSV output, have you looked at those?

tshark is the command line application in the wireshark suite that will read a pcap file and return the text version of the dissection of the traffic in the file.

The input file is specfied with a -r filename option.

To produce output in csv format you'll need to use the -T fields option and then -E separator=, and possibly -E header=y and then supply a list of all fields you want to see with multiple -e options, e.g. -e frame.number -e frame.time. The field names are those used in display filters in Wireshark and can be seen by opening the capture file in Wireshark, selecting the field in the packet details pane and then looking at the details in the status bar.

Because you have to specify the required fields for "CSV" output, you may find it easier to process XML output, in this case use -T pdml or -T psml.