0

I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers:

  • Ether header (3)
  • IP header (12)
  • TCP header (10)
  • UDP header (4)

Then convert the PCAP into csv. But I could not extract Ether header (specifically: ether.dst). So, How can I extract all required headers' data?

enter image description here

3

You don't see the ethernet header because you are not capturing traffic on an Ethernet interface.

You are using the Linux cooked-mode capture. As per this answer on StackOverflow, which itself refers to The Wireshark Wiki this mode doesn't provide the link-layer header.

From the above Wiki page:

When capturing from the "any" device, or from one of those other devices, in Linux, the libpcap doesn't supply the link-layer header for the real "hardware protocol" like Ethernet, but instead supplies a fake link-layer header for this pseudo-protocol.

So to get the data you want you need to capture traffic on the ethernet interface itself.

Not the answer you're looking for? Browse other questions tagged or ask your own question.