Revision history  [back]

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get whichever field is indicated on the filter.

Instead, I would like to get the whole PCAP contents (plus the-e _ws.col.Info field). In that way the user could navigate through the file in a visual way, and later export whatever field he/she wants.

Let me show you some pictures of how the program looks

Picture1

Picture 2

This is part of the code I came up with, if anybody finds it useful

    String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
    String fileNameWithExtension = Path.GetFileName(pcapFilePath);
    String pathWorkingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

    String pathFilteredPcap = "\"" + pathWorkingFolder + fileNameWithoutExtension + "_filtered.pcap\"";
    String argumentsPcapToFilteredPcap = "-r \"" + pcapFilePath + "\" -Y camel -w " + pathFilteredPcap;

    String consoleOutputPcapToFilteredPcap = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsPcapToFilteredPcap);

    Console.WriteLine(consoleOutputPcapToFilteredPcap);
    Console.WriteLine("Filtered PCAP ready...");

    String pathJsonFile = pathWorkingFolder + fileNameWithoutExtension + ".json";
    String argumentsFilteredPcapToJson = "-r " + pathFilteredPcap + " -T json ";

    Console.WriteLine("Generating JSON...");

    String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsFilteredPcapToJson);

    UtilsIO.saveTextFile(consoleOutputFromPcapToJson, pathJsonFile);

    Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get whichever field is indicated on the filter.

Instead, I would like to get the whole PCAP contents (plus the-e _ws.col.Info field). In that way the user could navigate through the file in a visual way, and later export whatever field he/she wants.

Let me show you some pictures of how the program looks

Picture1

Picture 2

This is part of the code I came up with, if anybody finds it useful

    String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
    String fileNameWithExtension = Path.GetFileName(pcapFilePath);
    String pathWorkingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

    String pathFilteredPcap = "\"" + pathWorkingFolder + fileNameWithoutExtension + "_filtered.pcap\"";
    String argumentsPcapToFilteredPcap = "-r \"" + pcapFilePath + "\" -Y camel -w " + pathFilteredPcap;

    String consoleOutputPcapToFilteredPcap = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsPcapToFilteredPcap);

    Console.WriteLine(consoleOutputPcapToFilteredPcap);
    Console.WriteLine("Filtered PCAP ready...");

    String pathJsonFile = pathWorkingFolder + fileNameWithoutExtension + ".json";
    String argumentsFilteredPcapToJson = "-r " + pathFilteredPcap + " -T json ";

    Console.WriteLine("Generating JSON...");

    String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsFilteredPcapToJson);

    UtilsIO.saveTextFile(consoleOutputFromPcapToJson, pathJsonFile);

    Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get whichever field is indicated on the filter.

Instead, I would like to get the whole PCAP contents (plus the-e _ws.col.Info field). In that way the user could navigate through the file in a visual way, and later export whatever field he/she wants.

Let me show you some pictures of how the program looks

Picture1

Picture 2

This is part of the code I came up with, if anybody finds it useful

  String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
     String fileNameWithExtension = Path.GetFileName(pcapFilePath);
    String pathWorkingFolder         String workingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

    String pathFilteredPcap = "\"" + pathWorkingFolder + fileNameWithoutExtension + "_filtered.pcap\"";
    String argumentsPcapToFilteredPcap         String pcapToFilteredPcapArguments = "-r \"" + pcapFilePath + "\" -Y camel -w " + pathFilteredPcap;

    String consoleOutputPcapToFilteredPcap \"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String output = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsPcapToFilteredPcap);

    Console.WriteLine(consoleOutputPcapToFilteredPcap);
pcapToFilteredPcapArguments);

            Console.WriteLine(output);

            Console.WriteLine("Filtered PCAP ready...");

    String pathJsonFile = pathWorkingFolder         String temporaryPcapFilename = "\"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String JsonFilePath = workingFolder + fileNameWithoutExtension + ".json";
    String argumentsFilteredPcapToJson 
            Console.WriteLine("Generating JSON...");

            String pcapToJsonArguments = "-r " + pathFilteredPcap temporaryPcapFilename + " -T json ";

    Console.WriteLine("Generating JSON...");

     String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, argumentsFilteredPcapToJson);

pcapToJsonArguments);

            UtilsIO.saveTextFile(consoleOutputFromPcapToJson, pathJsonFile);

JsonFilePath);

            Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get whichever field is indicated on the filter.

Instead, I would like to get the whole PCAP contents (plus the-e _ws.col.Info field). In that way the user could navigate through the file in a visual way, and later export whatever field he/she wants.

Let me show you some pictures of how the program looks

Picture1

Picture 2

This is part of the code I came up with, if anybody finds it useful

   String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
            String fileNameWithExtension = Path.GetFileName(pcapFilePath);
            String workingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

            String pcapToFilteredPcapArguments = "-r \"" + pcapFilePath + "\" -Y camel -w \"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String output = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToFilteredPcapArguments);

            Console.WriteLine(output);

            Console.WriteLine("Filtered PCAP ready...");

            String temporaryPcapFilename = "\"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String JsonFilePath = workingFolder + fileNameWithoutExtension + ".json";

            Console.WriteLine("Generating JSON...");

            String pcapToJsonArguments = "-r " + temporaryPcapFilename + " -T json ";

            String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToJsonArguments);

            UtilsIO.saveTextFile(consoleOutputFromPcapToJson, JsonFilePath);

            Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get whichever the selected field is indicated on in the filter.

Instead, I would like to get the whole PCAP contents (plus the-e _ws.col.Info field). In that way the user could to be able to navigate through the file in a visual way, it and later export whatever field he/she wants.different fields to MySql as required.

Let me show you some pictures of how the program looks

Picture1

Picture 2

This is part of the code I came up with, if anybody finds it useful

   String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
            String fileNameWithExtension = Path.GetFileName(pcapFilePath);
            String workingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

            String pcapToFilteredPcapArguments = "-r \"" + pcapFilePath + "\" -Y camel -w \"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String output = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToFilteredPcapArguments);

            Console.WriteLine(output);

            Console.WriteLine("Filtered PCAP ready...");

            String temporaryPcapFilename = "\"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String JsonFilePath = workingFolder + fileNameWithoutExtension + ".json";

            Console.WriteLine("Generating JSON...");

            String pcapToJsonArguments = "-r " + temporaryPcapFilename + " -T json ";

            String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToJsonArguments);

            UtilsIO.saveTextFile(consoleOutputFromPcapToJson, JsonFilePath);

            Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get the selected field in the filter.

I would like to get the whole PCAP contents plus file as PCAP, plus, the-e _ws.col.Info field field, to be able to navigate through it and later export different fields to MySql as required.to MySql.

Let me show you some pictures of how the program looks

Picture1

Picture 2

This is part of the code I came up with, if anybody finds it useful

   String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
            String fileNameWithExtension = Path.GetFileName(pcapFilePath);
            String workingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

            String pcapToFilteredPcapArguments = "-r \"" + pcapFilePath + "\" -Y camel -w \"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String output = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToFilteredPcapArguments);

            Console.WriteLine(output);

            Console.WriteLine("Filtered PCAP ready...");

            String temporaryPcapFilename = "\"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String JsonFilePath = workingFolder + fileNameWithoutExtension + ".json";

            Console.WriteLine("Generating JSON...");

            String pcapToJsonArguments = "-r " + temporaryPcapFilename + " -T json ";

            String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToJsonArguments);

            UtilsIO.saveTextFile(consoleOutputFromPcapToJson, JsonFilePath);

            Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, when I apply the aforementioned filters, I stop getting the whole PCAP file translated as JSON, and only get the selected field in the filter.

I would like I'm not very sure how to get the whole file as PCAP, plus, the-e _ws.col.Info field, to be able to navigate through it and later export to MySql.

Let me show you some pictures of how the program looks

Picture1

do that on a generated .JSON

This is part of the code I came up with, if anybody finds it useful

   String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
            String fileNameWithExtension = Path.GetFileName(pcapFilePath);
            String workingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

            String pcapToFilteredPcapArguments = "-r \"" + pcapFilePath + "\" -Y camel -w \"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String output = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToFilteredPcapArguments);

            Console.WriteLine(output);

            Console.WriteLine("Filtered PCAP ready...");

            String temporaryPcapFilename = "\"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String JsonFilePath = workingFolder + fileNameWithoutExtension + ".json";

            Console.WriteLine("Generating JSON...");

            String pcapToJsonArguments = "-r " + temporaryPcapFilename + " -T json ";

            String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToJsonArguments);

            UtilsIO.saveTextFile(consoleOutputFromPcapToJson, JsonFilePath);

            Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL analysis, for example, "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as I CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, I'm not very sure how to do that on a generated .JSON

This is part of the code I came up with, if anybody finds it useful

   String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
            String fileNameWithExtension = Path.GetFileName(pcapFilePath);
            String workingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

            String pcapToFilteredPcapArguments = "-r \"" + pcapFilePath + "\" -Y camel -w \"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String output = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToFilteredPcapArguments);

            Console.WriteLine(output);

            Console.WriteLine("Filtered PCAP ready...");

            String temporaryPcapFilename = "\"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String JsonFilePath = workingFolder + fileNameWithoutExtension + ".json";

            Console.WriteLine("Generating JSON...");

            String pcapToJsonArguments = "-r " + temporaryPcapFilename + " -T json ";

            String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToJsonArguments);

            UtilsIO.saveTextFile(consoleOutputFromPcapToJson, JsonFilePath);

            Console.WriteLine("JSON Ready...");

As always thank you very much!

Hi again guys!

I'm making a little C# code to export expanded PCAP files to a Database.

So far I have succeeded in creating the JSON, however, I noticed that a very nice Wireshark column, _ws.col.Info, is missing on the generated file.

This column would contain very important information for DIAMETER and CAMEL Camel analysis, for example, example "SACK invoke InitialDP","invoke eventReportBCSM",""SACK invoke release call", among others.

On previous projects where I was required to export the PCAP as I CSV, I was able to do so by using switches like the following one:

-e frame.number -e frame.time -e _ws.col.Info -e diameter.Session-Id -e e164.msisdn -e e212.imsi

However, I'm not very sure how to do that on a generated .JSON

This is part of the code I came up with, if anybody finds it useful

   String fileNameWithoutExtension = Path.GetFileNameWithoutExtension(pcapFilePath);
            String fileNameWithExtension = Path.GetFileName(pcapFilePath);
            String workingFolder = pcapFilePath.Replace(fileNameWithExtension, "");

            String pcapToFilteredPcapArguments = "-r \"" + pcapFilePath + "\" -Y camel -w \"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String output = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToFilteredPcapArguments);

            Console.WriteLine(output);

            Console.WriteLine("Filtered PCAP ready...");

            String temporaryPcapFilename = "\"" + workingFolder + fileNameWithoutExtension + "_filtered.pcap\"";

            String JsonFilePath = workingFolder + fileNameWithoutExtension + ".json";

            Console.WriteLine("Generating JSON...");

            String pcapToJsonArguments = "-r " + temporaryPcapFilename + " -T json ";

            String consoleOutputFromPcapToJson = await new UtilsIO().executeExe(SHARK_INSTALL_FOLDER, pcapToJsonArguments);

            UtilsIO.saveTextFile(consoleOutputFromPcapToJson, JsonFilePath);

            Console.WriteLine("JSON Ready...");

As always thank you very much!