Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Easiest way to convert pcap to JSON

I have a bunch of pcap files, created with tcpdump. I would like to store these in a database, for easier querying, indexing etc. I thought mongodb might be a good choice, because storing a packet the way Wireshark/TShark presents them as JSON document seems to be natural.

It should be possible to create PDML files with tshark, parse these and insert them into mongodb, but I am curious if someone knows of an existing/other solution.

like image 236
Erik Avatar asked Sep 08 '12 13:09

Erik


People also ask

How do I convert pcap to CSV?

csv file? In Wireshark you need to go to File > Export Packet Disscetions > a "CSV" (Comma Separated Values packet summary) file.

Can Wireshark read pcap?

To load a PCAP file in Wireshark, open Wireshark and in the menu bar, click 'File', then click 'Open' and navigate to the file's location, then click 'Open. ' In our analysis of the PCAP file, we will try three analysis techniques to find any indicators of malicious activity. These steps can be performed in any order.


3 Answers

On the command line (Linux, Windows or MacOS), you can use tshark.

e.g.

tshark -r input.pcap -T json >output.json

or with a filter:

tshark -2 -R "your filter" -r input.pcap -T json >output.json

Considering you mentioned a set of pcap files, you can also pre-merge the pcap files into a single pcap and then export that in one go if preferred..

mergecap -w output.pcap input1.pcap input2.pcap.. 
like image 135
Cormac Long Avatar answered Sep 18 '22 14:09

Cormac Long


Wireshark has a feature to export it's capture files to JSON.

File->Export Packet Dissections->As JSON

like image 26
Ajay Thomas Avatar answered Sep 16 '22 14:09

Ajay Thomas


You could use pcaphar. More info about HAR here.

like image 20
Yehia Avatar answered Sep 20 '22 14:09

Yehia