Ethereal-users: Re: [Ethereal-users] saving ethereal results as a text file

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 24 Jan 2006 03:16:41 -0800
chedly ghedira wrote:
i want to analyse ethereal files by writing a script, but i noticed that only ethereal can open the file.
Actually, the file format Ethereal captures in, by default, is libpcap format, which can also be read by Tethereal (not a surprise, as it uses the same code), tcpdump, and various other programs that can read libpcap files. Perl has a Net::Pcap package in CPAN that can read libpcap files; other scripting languages might have libpcap support as well.
However, what you get when you read that file is raw packet data. You have to parse all the packet data yourself. 


How can i save the result as a file text,


File -> Export -> as Plain Text file.
That'll write out the summary list of packets, or the detailed dissection of all packets. 

There's also

File->Export->as "CSV"
File->Export->XML - "PSML"
File->Export->XML - "PDML"

which might be better formats for a script to process.