This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

In my current pcap file, I have over 500 TCP streams and UDP streams (according to the Statistics -> Conversations in Wireshark). But many of them only have a few packets being passed between the source and destination.

I want to analyze the streams that have more than, say 100 packets, sent from A to B. I saw a way to save tcp streams to separate pcap files here: https://ask.wireshark.org/questions/4677/easy-way-to-save-tcp-streams

But that command saves all the tcp streams, which I don't need. As a matter of fact, I don't need all the payload either, I only want all the basic information of each stream saved in a separate file. I thought about exporting straight from Wireshark, but that wouldn't group them according to individual flows.

So basically, I want a way to save all the packet information (without the payload) of every flow (that has more than 100 packets) in separate files. Is there anyway to do this?

Thanks for the help!

asked 10 Dec '16, 20:54

mrk's gravatar image

mrk
11113
accept rate: 0%


You can do this with TraceWrangler, using the latest semi-automated build available here: https://www.tracewrangler.com/download/automated/

  1. Start TraceWrangler
  2. Add capture file(s) to the list
  3. Open Tools -> Conversation Summary
  4. Select TCP Tab, and sort by "Packets" column with descending number of packets
  5. Mark the number of rows you want, e.g. by clicking on the first row, and using Shift + Cursor down
  6. Right click on the selected rows, and select "Extract" -> "to multiple files"
  7. Activate the "Truncate" checkmark box and select "Layer 4"
  8. Press the "Okay" button to run the extraction

You should get a sub directory called "extracted" with one file per flow.

permanent link

answered 12 Dec '16, 05:36

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thank you! This is exactly what I wanted

(13 Dec '16, 21:41) mrk
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×82
×35
×18

question asked: 10 Dec '16, 20:54

question was seen: 1,906 times

last updated: 13 Dec '16, 21:41

p​o​w​e​r​e​d by O​S​Q​A