Parsing *.pcap files


#1

Hello all! :wink:
I have many pcap files and want to automatize the parsing of them. Sorry for my English.
I want:
1)open pcap file
2)use some filters
3)save results in another file
I use command:
Run(‘C:\Program Files\Wireshark\wireshark.exe -r D:\test\1.pcap -R “ip.addr == 192.168.3.148 || ip.addr == 192.168.3.189” -R “tcp.port == 80 || tcp.port == 443 || tcp.port == 53” -p -w D:\test\parsed1.pcap -a duration:3’)
But it does’t save results in parsed1.pcap :frowning:
Can you tell me how can I do 3) ? Thanks!


#2

Hello,

You can use tshark for this.
tshark is the terminal version of wireshark.

-p seems useless here.

-a duration:3 must be used only for a capture.
you are using -r D:\test\1.pcap, so this is not a capture.
tshark does not like it :
tshark: A maximum capture time was specified, but a capture isn’t being done.
and no output file

Olivier


#3

Thanks, it works :slight_smile: