I am trying to automate a repetitive manual process for which I use WireShark:
1) Load a given pcap file
2) Apply a simple filter for a given protocol
3) Use the export dialog box to export the displayed packets to CSV file
4) Use the export dialog box to export the displayed packets in XML PDML form.
This is tedious, and requires human involvement in the middle of a process that is mostly automated (including the analysis of the files to produce reports).
Is there some way to either automate Wireshark, or do somehow access the underlying libraries used for export?
UPDATE: As several people here indicated, TShark turns out to be the way to go. The exact command line I ended up using is:
tshark -r MyDataFile.pcap -T pdml -R MyProtocol > MyOutputFile.xml\
I then use an event based XML parser (Python's expat) to parse the generated 2GB file
I watched at the dependency list of wireshark on my debian system, and I found Tshark: it's the command line version of wireshark.
It seems interesting, but I didn't read the manual yet, however it's for sure more script friendly.
Also I'll stay tuned on this thread and post more info when I'll start using it.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With