Ethereal-users: Re: [Ethereal-users] Export for post treatment

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 25 Mar 2003 22:49:26 -0800
On Wed, Mar 26, 2003 at 07:44:54AM +0100, Wenger Serge wrote:
> How can I export data to csv, bin, hex, xml or another well defined format
> to do these search in a post treatment.

You could either run Tethereal with the "-x" flag, or print to a file
and enable the hex dump; that gives you a text file that includes the
raw hex packet data.

I'm not sure what "bin" is.

You could also just write your own program to read an Ethereal capture,
given that its native format is just libpcap format; you could even try
writing it in Perl:

	http://search.cpan.org/author/TIMPOTTER/Net-Pcap-0.04/Pcap.pm

lets you read libpcap files - use Net::Pcap::open_offline to open the
capture file, and use Net::Pcap::loop to scan through the packets in the
file.