This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a pcap file, to which I have applied some filters (so, they are non-sequential) and have marked a subset of packets from which I would like to extract their protocol specific data fields from. How can I do this?

File->Export Specified Packets gives me whole frames. File->Export Packet Bytes is what I'm looking for, but that option only outputs the selected frame, not the range...

GUI or terminal solutions would be acceptable.

asked 30 Apr '16, 05:52

J%20B's gravatar image

J B
11114
accept rate: 0%


Export Packet Bytes works on a single packet because in a raw data output, there is no way to separate the pieces of data coming from individual packets from each other. Your particular task may not require the separation (i.e. a continuous stream of raw data may be what you actually need), however that's how it works now.

If you don't mind that the contents of the protocol fields you are interested in is not always output as hex but sometimes as an ASCII string, then tshark -r your_file_name -Y "your_display_filter_expression" -T fields -e field_1_name -e field_2_name is your best friend; if not, try -T pdml instead, where you get show and value items for most (yet not all) fields, like in the following example:

< field name="usb.urb_ts_usec" showname="URB usec: 948741" size="4" pos="24" show="948741" value="057a0e00"/>

However, the -e option does not work together with -T pdml, so the output is really huge. And you'll have to post-process the pdml output with something grep- and sed-like to extract only the required data from it.

While you cannot mark packets in tshark, you can use the display filter to define ranges. -Y "tcp and ((frame.number >= 5 and frame.number <= 10) or (frame.number >= 100 and frame.number <= 108))" is an example of a filter which lets through all TCP packets which exist inside ranges 5-10 and 100-108.

Instead of (commandline) tshark, you may use File -> Export Packet Dissections -> As PDML XML in (GUI) Wireshark for the same purpose; in this case, you can specify the list of ranges directly in a dedicated form field (like 5-10,100-108 to match the above example), yet the need to post-process the pdml output remains.

permanent link

answered 01 May '16, 05:28

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 01 May '16, 05:50

Thank you very much, for a most detailed explanation! It's too bad that the Wireshark can't do this in itself, but exporting to XML and writing a Python script to post-process it should work well!

(01 May '16, 08:11) J B
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×76
×7

question asked: 30 Apr '16, 05:52

question was seen: 8,136 times

last updated: 01 May '16, 08:11

p​o​w​e​r​e​d by O​S​Q​A