LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-22-2014, 03:06 PM   #1
kikilinux
Member
 
Registered: Sep 2012
Posts: 126

Rep: Reputation: Disabled
Question How to export just source/destination field of pcap file into a plain text file


I have a pcap file which I want to extract specific fields into a text file.
for example I need to extract source and destination IP field from a pcap file into a file like bellow:
Code:
1079733053 453496064
1079733007 2326590059
1079733006 3827200703
Does it exist any way to extract these field just like above or any way same the above?
 
Old 11-22-2014, 04:36 PM   #2
Keith Hedger
Senior Member
 
Registered: Jun 2010
Location: Wiltshire, UK
Distribution: Void, Linux From Scratch, Slackware64
Posts: 3,171

Rep: Reputation: 861Reputation: 861Reputation: 861Reputation: 861Reputation: 861Reputation: 861Reputation: 861
Take a look at awk.
P.S. Might have been helpful to include a sample of the source file you are trying to manipulate, asnot everyone will know the format of a pcap file.
 
1 members found this post helpful.
Old 11-25-2014, 02:50 PM   #3
nini09
Senior Member
 
Registered: Apr 2009
Posts: 1,868

Rep: Reputation: 162Reputation: 162
Following link is pcap format, http://wiki.wireshark.org/Development/LibpcapFileFormat.
In packet data section, it should be normal Ethernet format.
 
1 members found this post helpful.
Old 11-25-2014, 04:43 PM   #4
Keith Hedger
Senior Member
 
Registered: Jun 2010
Location: Wiltshire, UK
Distribution: Void, Linux From Scratch, Slackware64
Posts: 3,171

Rep: Reputation: 861Reputation: 861Reputation: 861Reputation: 861Reputation: 861Reputation: 861Reputation: 861
Really doesn't help, I'm not going to spend a couple of hours trying to sort out the various fields from the data structures because you can't be bothered just to attatch an example file like you was asked for, I am just getting so fed up with peolple on these forums wanting it all done for them, they can't even be bothered to supply data and info they have been asked for by the people that they expect to help them.
I am un subscribing from this thread, good luck!
 
1 members found this post helpful.
Old 11-26-2014, 10:30 AM   #5
kikilinux
Member
 
Registered: Sep 2012
Posts: 126

Original Poster
Rep: Reputation: Disabled
Dear Keith Hedger
Tnx to answer
Maybe I am still working on ur answer and I have not obtain any results.
Maybe if I got answer I tell ur answer was helpful.
 
Old 11-27-2014, 07:13 AM   #6
kikilinux
Member
 
Registered: Sep 2012
Posts: 126

Original Poster
Rep: Reputation: Disabled
Smile

I've employ wireshark to open pcap files and then export it as "plain text" file and then in packet format option I unchecked packet detailed.
The result file was as follow :
Quote:
1 0.000000 51.142.253.91 15.236.229.88 TCP 54 compaq-wcp > 22746 [SYN] Seq=0 Win=512 Len=0
It is enaugh for me to solve my problem.
To select source IP and destination IP I employed the bellow command:
Quote:
cat myfile | while read f1 f2 f3 f4 f5
do
// The code effects on f3 and f4
done
awk seems good tools, I am working on it for future purposes.
 
  


Reply

Tags
pcap file, wireshard


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
copy the file whose source path is mentioned in a file to the specified Destination bluepenguine Linux - General 1 06-03-2010 05:31 AM
Password blocked by hidden field, but in plain text when I view source abefroman Linux - Security 4 09-15-2009 11:21 AM
Run commands found in plain text file splunk Linux - Software 6 02-02-2008 11:15 AM
.ram file shows as text/plain biosnacky Linux - Newbie 8 01-07-2007 08:21 PM
not a plain text file wazza4610 Linux - Newbie 1 11-22-2005 04:20 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 05:16 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration