This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TShark CSV output problem

0

Hi all, I am trying to create a nice CSV file from a trace, but instead of a readable CSV file I get a file with all sorts of characters all over the place. Am I doing something wrong with encoding or so (windows)? the command I used is below:

tshark.exe -T fields -E separator=, -E quote=d -e frame.number -e ip.dst -e ip.src -e eth.dst -e eth.src -e tcp.srcport -e udp.srcport -e tcp.dstport -e upd.dstport -w stats.csv -r trace.pcap

asked 12 Dec '11, 14:02

Bram%20van%20den%20Bosch's gravatar image

Bram van den...
6113
accept rate: 0%


One Answer:

3

You're doing it almost right :-)

The "-w" means write the captured packets to disk (binary). What you want is to redirect your tshark output to file. You can do this with "> file.csv". The command will become:

tshark.exe -T fields -E separator=, -E quote=d -e frame.number -e ip.dst -e ip.src \
  -e eth.dst -e eth.src -e tcp.srcport -e udp.srcport -e tcp.dstport -e upd.dstport \
  -r trace.pcap > stats.csv

Hope this helps!

answered 12 Dec '11, 14:08

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Super, works like expected now. Thanks for the help

(13 Dec '11, 09:51) Bram van den...