Filter fields in JSON export

fields
retag add tags

Hi Team,

I am trying to read one pcap file, & convert it into Json file using tshark. After converting to Json file, It takes 250Mb per file. There are some fields like frame length, frame number, frame delta difference which are not required in json. Is there any way by which i can discard some of the fields related to frame information while converting to json. Please suggest.

Thanks & Regards, Neha Malhotra

Neha malhotra

asked 2020-01-27 12:09:02 +0000

13.7k

Jaap

updated 2020-01-27 13:49:24 +0000

edit flag offensive 0 remove flag close merge delete

Comments

There's no explicit way to exclude protocols or fields.
You would need to make a pass through the capture to get a protocol list, remove the not needed ones then run another pass with "-J" to only include those protocols. Or grep out what is not needed.

tshark -T json -r ./wireshark_issue.pcap | grep -v "\"frame\."

Not sure what your receiver will do with the empty frame section:

"frame": {
},

Chuckc (2020-01-27 15:17:27 +0000) edit

Thanks for providing your inputs. Tried using the above mentioned command, It seems it did not filter out the data.

Do we have any command by which we can remove frame related information. For example, I want to remove rows with field name =frame.encap_type & frame.offset_shift

 <proto name="frame" showname="Frame 1: 56 bytes on wire (448 bits), 56 bytes captured (448 bits)" size="56" pos="0">
    <field name="frame.encap_type" showname="Encapsulation type: IEEE 802.15.4 Wireless PAN (104)" size="0" pos="0" show="104"/>
    <field name="frame.time" showname="Arrival Time: Sep 20, 2019 15:30:02.799216000 GMT Daylight Time" size="0" pos="0" show="Sep 20, 2019 15:30:02.799216000 GMT Daylight Time"/>
    <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
    <field name="frame.time_epoch" showname ...

(more)

Neha malhotra (2020-01-30 12:02:02 +0000) edit

What is the command string used to produce the output above?

Chuckc (2020-01-30 13:44:31 +0000) edit

tshark -r file.pcap -T pdml > file.xml

Neha malhotra (2020-01-30 15:05:19 +0000) edit

Can't you use xml tools such as an xml transform (xslt) to post-process the xml? That's assuming the pdml output is well-formed.

grahamb (2020-01-30 19:24:35 +0000) edit

add a comment see more comments

Filter fields in JSON export

Comments

1 Answer

Comments

Your Answer

Filter fields in JSON export edit

Comments

1 Answer

Comments

Your Answer

Filter fields in JSON export