Exporting pcap file into csv with all informations

0
votes

I tried exporting a pcap file into a CSV from Wireshark. But while doing so I just get the basic data like Frame No, Time, Source, Destination, Protocol, Length and Info. But while exporting the same pcap file as a plain text file or JSON file includes all the detailed information about the packet. How to get the columns like

  • duration
  • protocol_type
  • service
  • flag
  • src_bytes
  • dst_bytes
  • land
  • wrong_fragment
  • urgent
  • hot
  • num_failed_logins
  • logged_in
  • num_compromised
  • root_shell
  • su_attempted
  • num_root
  • num_file_creations
  • num_shells
  • num_access_files
  • num_outbound_cmds
  • is_host_login
  • is_guest_login
  • count
  • srv_count
  • serror_rate
  • srv_serror_rate
  • rerror_rate
  • srv_rerror_rate
  • same_srv_rate
  • diff_srv_rate
  • srv_diff_host_rate
  • dst_host_count
  • dst_host_srv_count
  • dst_host_same_srv_rate
  • dst_host_diff_srv_rate
  • dst_host_same_src_port_rate
  • dst_host_srv_diff_host_rate
  • dst_host_serror_rate
  • dst_host_srv_serror_rate
  • dst_host_rerror_rate
  • dst_host_srv_rerror_rate

Does a single packet has all these field details? If there is another way to get these please suggest them

2
csvnetworkingwiresharkpacketpcap

2 Answers

0
votes

Every packet potentially has a different set of fields. That's why CSV is not a good format for this kind of thing unless you have a very specific set of fields you're interested in. For example, an ARP packet will have details of the Ethernet header, as well as ARP fields, but it won't have details of an IP header, or a TCP header, or an HTTP packet, etc. Whereas an HTTP packet will have Ethernet, IP, TCP and HTTP fields but won't normally have the ARP fields. Wireshark supports hundreds of protocols and so by default, field values are only printed for those protocols/fields present in the packet.

It's possible with -T fields and multiple -e <field_name> options to specify all the fields you might want to see. But you will get a value for each of those fields for every packet (empty if that field doesn't apply to the particular packet). That could be suitable for a CSV.

0
votes

I later found that most of the fields that I mentioned in the question are flow-related information, not just a packet.

https://github.com/ahlashkari/CICFlowMeter

Check this above repository, it extracts 82 features. The data can be captured or imported from a pcap file.