1
votes

I have a pcap file with me and I opened it in Wireshark, I want to extract a specific field basically the "Info" field from the pcap trace and port it to a text file, which I can then parse and use for data analysis. I looked up certain StackOverflow posts and those posts mentioned to use TShark, but I couldn't find any way of extracting the "info" field using TShark. It would be great if someone could point me to an automated way of dumping field specific data to a text file. I have also pasted the image of the wireshark dump for convenience.

enter image description here

2

2 Answers

1
votes

With tshark version 1.12.0 or later:

tshark -r inFile.pcap -T fields -e _ws.col.Info > outFile.csv
0
votes

tshark -r FILE -T fields -e col.info

All of these options are documented in the manual: http://www.wireshark.org/docs/man-pages/tshark.html