将pcap数据导出到csv:时间戳，字节，上行/下行，额外信息 [英] Export pcap data to csv: timestamp, bytes, uplink/downlink, extra info

问题描述

我想知道是否有任何工具可以解析pcap数据并将其转换为具有以下信息的csv文件:

I was wondering if there is any tool that can parse pcap data and convert it to a csv file with the following information:

时间戳，字节，上行链路/下行链路，一些其他信息.

timestamp, bytes, uplink/downlink, some extra info..

基本上，可以通过IP/MAC地址看到上行链路/下行链路，并不需要额外的信息，但是我的意思是例如选择数据包的特定字段.

Basically, the uplink/downlink could be seen by the IP/MAC address, and the extra info is not really needed, but what I mean with that is choose a specific field of a packet for example.

我一直在尝试一些工具，但是我还没有找到合适的工具.否则，我将编写一个小的解析器. 预先感谢！

I have been trying some tools but I have not found the suitable one yet. Otherwise I will write a small parser. Thanks in advance!

推荐答案

TShark
以下是一些示例:

TShark
Here are some examples:

$ tshark -r test.pcap -T fields -e frame.number -e eth.src -e eth.dst -e ip.src -e ip.dst -e frame.len > test1.csv

$ tshark -r test.pcap -T fields -e frame.number -e eth.src -e eth.dst -e ip.src -e ip.dst -e frame.len -E header=y -E separator=, > test2.csv

$ tshark -r test.pcap -R "frame.number>40" -T fields -e frame.number -e frame.time -e frame.time_delta -e frame.time_delta_displayed -e frame.time_relative -E header=y > test3.csv

$ tshark -r test.pcap -R "wlan.fc.type_subtype == 0x08" -T fields -e frame.number -e wlan.sa -e wlan.bssid > test4.csv

$ tshark -r test.pcap -R "ip.addr==192.168.1.6 && tcp.port==1696 && ip.addr==67.212.143.22 && tcp.port==80" -T fields -e frame.number -e tcp.analysis.ack_rtt -E header=y > test5.csv

$ tshark -r test.pcap -T fields -e frame.number -e tcp.analysis.ack_rtt -E header=y > test6.csv

这篇关于将pcap数据导出到csv:时间戳，字节，上行/下行，额外信息的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！