Revision history [back]

Revision 2

updated 2019-11-13 00:13:53 +0000

I would recommend using tshark for this purpose. For example:

tshark -r huge.pcap -Y "gtp.message == 0x10" -T fields -E header=y -E separator=, -E quote=d -e frame.number -e e212.imsi -e e164.msisdn -e gtp.lac -e gtp.sai_sac > huge.csv

Add as many fields as you need using -e.

EDIT I changed the separator from a tab to a comma, which is what I originally intended for a .csv file.

Revision 1

11.1k

cmaynard

answered 2019-11-12 20:12:01 +0000

I would recommend using tshark for this purpose. For example:

tshark -r huge.pcap -Y "gtp.message == 0x10" -T fields -E header=y -E separator=, separator=/t -E quote=d -e frame.number -e e212.imsi -e e164.msisdn -e gtp.lac -e gtp.sai_sac > huge.csv

Add as many fields as you need using -e.

EDIT I changed the separator from a tab to a comma, which is what I originally intended for a .csv file.