0

Already seen here, here and here but I want to convert the whole pcap files with ALL the fields using tshark. I have quite a few pcap files that need conversion. I don't mind using python or tshark

The question is if its possible to convert without manually entering the required field names (I want all the field names by default)?

tvm

Shery
  • 1,808
  • 5
  • 27
  • 51
  • It's unclear what this csv will look like (you should provide example text). While you're at it, please make sure the question follows this [question checklist](https://codeblog.jonskeet.uk/2012/11/24/stack-overflow-question-checklist/). – Ross Jacobs May 05 '20 at 06:31
  • csv will hold all the cols with its values? for example if the pcap has 10 cols with 10 values then they are just comma separated which could be uploaded to a database. are you asking from a python perspective or is there something else i am just missing? – Shery May 05 '20 at 08:42
  • Related: [MCVE](https://stackoverflow.com/help/minimal-reproducible-example). Please edit your question to conform to this. – Ross Jacobs May 05 '20 at 08:51

1 Answers1

0

You can use Python and tshark to automate this:

import os

for file in os.listdir('your/path-to-pcap/'):
  output_csv = file + '.csv'
  os.system(f"tshark -N n -r ./test/{file} -T fields -e frame.number -e _ws.col.Time -e _ws.col.Source -e _ws.col.Destination -e _ws.col.Protocol -e _ws.col.Length -e _ws.col.Info -E header=y -E separator=, > {output_csv}")
Zahrizhal Ali
  • 1
  • 2