Conversion of a full .pcap file (incl. header information) into txt using tshark?

[Vivek Ganti]

Hi,

Scenario:

I have a stored .pcap file of Wireshark.

Using command prompt (tshark command), i want to convert the .pcap file into a text file and store it with all information extracted from the .pcap file.
How should i do this?

Currently, when i do this:
tshark -nr "C:\Users\V ivek Ganti\pcap_file .pcap" -T text > "C:\Users\V ivek Ganti\myoutput. txt"

in the myoutput.txt, i only see basic information of the packets and not their header information, i.e., i only see this:

1 0.000000 00:22:fa:9c:c9: 7c -> ff:ff:ff:ff:ff: ff ARP Who has 192.168.1.1? Tell 192.168.1.102
2 0.513198 192.168.1.102 -> 192.168.1.255 UDP Source port: 17500 Destination port: 17500


How do i see the full information of each packet using tshark?

Thank you very much in advance,
Vivek

[sicarie]

Did you try using fields and specifying all the fields instead of just dumping them to -T text ?

Such as

fields The values of fields specified with the -e option, in a form specified by the -E option. For example,

-T fields -E separator=, -E quote=d

would generate comma-separated values (CSV) output suitable for importing into your favorite spreadsheet program.

From the tshark info page

[Vivek Ganti]

Did you try using fields and specifying all the fields instead of just dumping them to -T text ?

Such as

From the tshark info page

Hey!

So i just tried adding -V after the -T text in the command. Saw it on the link you sent.
Works like a charm!

Thanks a million!

[sicarie]

Awesome, thanks for posting the result!