First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Difficulty converting .pcap file into a .csv file with all available columns

Hello. I'm trying to convert a set of .pcap files into individual .csv (comma separated value) text files so that I can analyze them with statistical analysis software tools. I'm able to extract 6 columns from the attached .pcap file (Time, Source, Destination, Protocol, Length, Info) but I am missing a great deal more information that I would expect to see, such as port address, payload information, server delay, etc.

I'm trying to extract ALL possible variables from each pcap observation row. Any help would be appreciated. THANKS

sonak's avatar
1
sonak
asked 2022-04-13 13:24:01 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Hello. When you export packet dissections, if you are using the default settings, it will only pull info from the columns that you currently have. Try adding columns for the values you want and it should export. If you find a value in the packet details pane and drag that field to the column heading bar, it should add a new column with that value for you. If a value isn't correctly fetched for a column, you can also change the filter used to get that data by right clicking on the column header, clicking 'edit column' and changing the filter directly.

One little caveat that I want to mention is occurrences. If a value appears more than once in a frame, it will be listed as a single field listing the values. Sometimes the export will cut answers short and thus leave some data out. I got around this when extracting QUIC packet lengths by using occurrences in my columns. When editing a column's filter directly, you can choose a value for which occurrence to display. I just made a bunch of columns to capture different occurrences and then exported.

Hope this works for you. Best of luck.

Ginny S's avatar
1
Ginny S
answered 2022-04-13 20:25:35 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer