Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is there a way to programatically export files using Wireshark's facilities?

Tags:

wireshark

pcap

I am trying to automate a repetitive manual process for which I use WireShark:

1) Load a given pcap file

2) Apply a simple filter for a given protocol

3) Use the export dialog box to export the displayed packets to CSV file

4) Use the export dialog box to export the displayed packets in XML PDML form.

This is tedious, and requires human involvement in the middle of a process that is mostly automated (including the analysis of the files to produce reports).

Is there some way to either automate Wireshark, or do somehow access the underlying libraries used for export?

UPDATE: As several people here indicated, TShark turns out to be the way to go. The exact command line I ended up using is:

tshark -r MyDataFile.pcap -T pdml -R MyProtocol > MyOutputFile.xml\

I then use an event based XML parser (Python's expat) to parse the generated 2GB file

like image 676
Uri Avatar asked Mar 09 '10 19:03

Uri


1 Answers

I watched at the dependency list of wireshark on my debian system, and I found Tshark: it's the command line version of wireshark.

It seems interesting, but I didn't read the manual yet, however it's for sure more script friendly.

Also I'll stay tuned on this thread and post more info when I'll start using it.

like image 199
Dacav Avatar answered Nov 13 '22 06:11

Dacav