I have a 1.5Gb capture of small UDP packets that I would like to turn into a CSV with just timestamp and UDP payload data in hex format.
An example of the desired output would be as follows:
% head Data3.txt 0.000000,0000000041000000005ec812ac00047dce00000000 0.000194,0000000042000000005ec812ac00047db500000000 0.000227,0000000041000000005ec812ac00047dce00000000 0.000619,0000000042000000005ec812ac00047db500000000 0.000663,0000000041000000005ec812ac00047dce00000000 0.000854,0000000042000000005ec812ac00047db500000000 0.000883,0000000041000000005ec812ac00047dce00000000
I do not need this exact format, just a format that can later be transformed into this data (in this case they are 21 bytes length UDP packets).
I am struggling to achieve this with tcpdump without success, so I have found that tshark can do the job:
tshark -r May31Jun5.pcap -t r -T fields -e frame.time -e data
That command gives the delta time and payload as required (see below excerpt).
Jun 1, 2020 00:02:27.567001000 CEST 0000000041000000005ed4297300049fe300000000 Jun 1, 2020 00:02:27.567014000 CEST 0000000042000000005ed4297300049fb100000000 Jun 1, 2020 00:02:27.567028000 CEST 0000000041000000005ed4297300049fe300000000 Jun 1, 2020 00:02:27.567042000 CEST 0000000042000000005ed4297300049fb100000000 Jun 1, 2020 00:02:27.567056000 CEST 0000000041000000005ed4297300049fe300000000 Jun 1, 2020 00:02:27.567066000 CEST 0000000042000000005ed4297300049fb100000000 Jun 1, 2020 00:02:27.567106000 CEST 0000000054000000005ed4297300049fb100000001 Jun 1, 2020 00:02:27.567124000 CEST 0000000041000000005ed4297300049fe300000000 Jun 1, 2020 00:02:27.567137000 CEST 0000000042000000005ed4297300049fb100000000 Jun 1, 2020 00:02:27.567152000 CEST 0000000041000000005ed4297300049fe300000000 Jun 1, 2020 00:02:28.095487000 CEST 0000000041000000005ed4297300049fe300000000
However I would like to have just seconds with decimals, so instead of:
Jun 1, 2020 00:02:28.095487000
It would be:
How can I achieve that? I guess it is possible because the GUI version of Wireshark display that value.
To get a CSV-style output for simple fields, you can use the
-T fields option with
tshark, combined with the
-E separator=, option to use commas as separator as opposed to tabs.
Next, to figure out what kind of field names to use, check the status bar in the GUI for a selected field, or use
tshark -T pdml -r some.pcap for example, or
tshark -G fields for a full list of supported fields.
For columns, you can use the special
_ws.col.<name> field. For example,
Combining this information, you can use something like:
tshark -r your.pcap -Tfields -Eseparator=, -eframe.time_relative -edata > your.csv
datafield will be empty. Add the
--disable-protocol dnsto avoid that.
udp.payloadoption has been added which should avoid the previous option. (commit v3.3.0rc0-250-gf04475167a)
-E occurence=1option to limit the results to the first value only.
External links referenced by this document: