Wireshark-users: Re: [Wireshark-users] packet dissection for documentation, bytes and tree
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Peter Wu <peter@xxxxxxxxxxxxx>
Date: Thu, 19 Jul 2018 13:10:08 +0200
Hi Marc,

On Wed, Jul 18, 2018 at 12:43:24PM +0000, Pawlowsky, Marc wrote:
> Is there a way to export the packet dissection and the bytes that make up the parts of the tree?
> 
> I am thinking of something like the tree on the Left hand side, and on the right all the bytes that make up that part of the tree.  Ideally just the leaves would be in the bytes section on the right.

What about File -> Export Packet Dissections -> As Plain Text? For
consumption by external programs, you can also try the "As PDML XML"
option which actually links the packet data to a field.

These options are also available through the "tshark" CLI program:

    tshark -r your.pcap -V > plain.txt
    tshark -r your.pcap -Tpdml > pdml.xml
-- 
Kind regards,
Peter Wu
https://lekensteyn.nl