I have multiple wireshark files (pcapng), and I need to have a summary of the ip adresses, ports, etc, ...
I found out that these informations can be produced in the "Statistics"->"IPv4 Statistics" menu and output to a txt/csv/xml/yaml file.
Is there any way to produce a single statistic file for multiple capture files?
I don't know if this helps, but TraceWrangler offers a multi file statistic for all files in the current file list:
To do that, run TraceWrangler, add all files you need, and select "Tools" -> "Communication Details" (available after the files were scanned once - if they're too big for automatic scan, you need to trigger the scan manually). You can export all rows of the summary to CSV via a popup menu.
This looks really close to the wireshark statistic menu, really cool software! Is the 2 GB file size limitation for a single capture file or for the entire file list?
It's for a single capture file. The list can hold any size; the biggest I tried to far was 600GB it total size for 5000 files
Either merge the capture files before hand, or merge the statistics files afterwards.
I don't think I can merge the capture files because of the size (I have hundreds of capture files each 50 MB). Do you know how I can merge the statistics files afterwards?
Comments