1

I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in for each packet is the data layer header/data. How can I extract this from all the packets and save to something like a txt, json, or csv?

I just read about tshark and attempted a line of code I found: tshark -r capture.pcap -T fields -e data > data.txt, but this returns an empty file. I can see the data I'm interested in through wireshark though.

4
  • Unfortunately, questions about programming are off-topic here. You can ask programming questions on Stack Overflow, but they will want more information. You can simply use Python to parse the file for you prior to the analysis that you want.
    – Ron Maupin
    Sep 6, 2018 at 20:16
  • It's not strictly a programming question though. I just said I want to analyze it in Python after resolving this issue. Are you saying that the only way to filter it is through Python rather than a networking tool and so that's why it's a programming question?
    – Austin
    Sep 6, 2018 at 20:18
  • We cannot recommend tools. Product or resource recommendations are explicitly off-topic for SE sites, except Software Recommendations and Hardware Recommendations. It would seem to me that you could simply have the application you are building do it all: parse the data then analyze it, rather than do those separately.
    – Ron Maupin
    Sep 6, 2018 at 22:17
  • 1
    It's likely you have the field name wrong. Use tshark -r capture.pcap -T json to dump the data with it's field names, and examine that output to get the names of the fields you want to output with the -e option.
    – vk5tu
    Sep 6, 2018 at 23:23

1 Answer 1

3

Hi think you should have a look to https://scapy.net/, with not too much programming you can achieve the task of extract the packets and parsing as json, cvs or whatever.

Not the answer you're looking for? Browse other questions tagged or ask your own question.