Tshark - Export packet info from pcap to cvs

问题

I am trying to programmatically capture a stream of packets by using Tshark. The simplified terminal command I am using is:

tshark -i 2 -w output.pcap

This is pretty straightforward, but I then need to get a .csv file in order to easily analyze the information captured. By opening the .pcap file in Wireshark and exporting it in .csv what I get is a file structured as follows:

"No.","Time","Source","Destination","Protocol","Length","Info"

but,again, I need to do this in an automatic way. So I tried using the command:

tshark -r output.pcap -T fields -e frame.number -e ip.src -e ip.dst -e frame.len -e frame.time -e frame.time_relative -E header=y -E separator=, > output.csv

but I can not find anywhere the name of the "Info" field I get when manually exporting the .csv. Any ideas? Thanks!

回答1:

Yes, you can if you use the latest Development Release.
See Wireshark Bug 2892.
Download the Development Release Version 1.9.0.

Use the following command:
$ tshark -i 2 -T fields -e frame.time -e col.Info

Output
Feb 28, 2013 20:58:24.604635000 Who has 10.10.128.203? Tell 10.10.128.1
Feb 28, 2013 20:58:24.678963000 Who has 10.10.128.163? Tell 10.10.128.1

Note
-e col.Info,
Use capital I