TShark CSV output problem

Question

Hi all, I am trying to create a nice CSV file from a trace, but instead of a readable CSV file I get a file with all sorts of characters all over the place. Am I doing something wrong with encoding or so (windows)? the command I used is below:

tshark.exe -T fields -E separator=, -E quote=d -e frame.number -e ip.dst -e ip.src -e eth.dst -e eth.src -e tcp.srcport -e udp.srcport -e tcp.dstport -e upd.dstport -w stats.csv -r trace.pcap

Accepted Answer

You're doing it almost right :-)

The "-w" means write the captured packets to disk (binary). What you want is to redirect your tshark output to file. You can do this with "> file.csv". The command will become:

tshark.exe -T fields -E separator=, -E quote=d -e frame.number -e ip.dst -e ip.src \
  -e eth.dst -e eth.src -e tcp.srcport -e udp.srcport -e tcp.dstport -e upd.dstport \
  -r trace.pcap > stats.csv

Hope this helps!