I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers:

  • Ether header (3)
  • IP header (12)
  • TCP header (10)
  • UDP header (4)

Then convert the PCAP into csv. But I could not extract Ether header (specifically: ether.dst). So, How can I extract all required headers' data?

enter image description here


You don't see the ethernet header because you are not capturing traffic on an Ethernet interface.

You are using the Linux cooked-mode capture. As per this answer on StackOverflow, which itself refers to The Wireshark Wiki this mode doesn't provide the link-layer header.

From the above Wiki page:

When capturing from the "any" device, or from one of those other devices, in Linux, the libpcap doesn't supply the link-layer header for the real "hardware protocol" like Ethernet, but instead supplies a fake link-layer header for this pseudo-protocol.

So to get the data you want you need to capture traffic on the ethernet interface itself.

Not the answer you're looking for? Browse other questions tagged or ask your own question.