tshark: Read filters were specified both with "-R" and with additional command-line arguments."
如果您包含太多列或出于任何未知原因，则会弹出此消息。
Look no further, wireshark is your best friend. It can open your pcap file and allow you to specify extra columns which you want. After this you can simply export them as csv. On the main interface, simply right on any one of the columns and select "column preference". This opens a new window which is very intuitive. Just add a new column and specify the field name. As simple as that.
I had tried tshark but trust me it becomes a bit annoying especially with this:
tshark: Read filters were specified both with "-R" and with additional command-line arguments."
This message pops up if you include too many columns or for whatever unknown reason.
Here is the python tool to divide the pcap into flows and output the extracted features into a CSV file
Try using flows_to_weka tool in python
This requires a version of scapy installed in your system and better to copy the scapy folder inside the weka folder. And copy the wfe.py, tcp_stream.py and entropy.py files inside the scapy folder. After you done this Your current directory should look something like this:
C:\Users\INKAKA\flows_to_weka\scapy
and copy the .pcap file into this folder and try running this command :
$python wfe.py -i input.pcap -t csv > output.csv
and you can also retrieve the features that you want by adding the required features in tcp_stream.py and wfe.py.
As noted in the comments to the question, to output the ip addresses for frames in a capture file in csv format use something like:
tshark -r <filename> -t fields -e ip.addr
See the tshark help for more information about options to set the separator and quoting characters in the csv output.
Field names can be determined by using Wireshark to examine the capture file and selecting a particular field in the details pane. The field name will be then shown in the status line at the bottom of the Wireshark window.
Is it possible that we can set fields separator other than comma ? Because in my PCap file, if i set the separator=, then my data in output file (.csv) doesn't looks good because i have , in my most of the columns.
So i want to know that is there any way we can set the field separator like other charactors i.e., | (pip) etc
发布评论
评论（8）
TShark
以下是一些示例：
TShark
Here are some examples:
别再犹豫了，wireshark 是你最好的朋友。它可以打开您的 pcap 文件并允许您指定所需的额外列。之后，您可以简单地将它们导出为 csv。在主界面上，只需右键单击任一列并选择“列首选项”即可。这将打开一个非常直观的新窗口。只需添加一个新列并指定字段名称即可。就这么简单。
我曾尝试过 tshark，但相信我，它会变得有点烦人，尤其是这样：
如果您包含太多列或出于任何未知原因，则会弹出此消息。
Look no further, wireshark is your best friend. It can open your pcap file and allow you to specify extra columns which you want. After this you can simply export them as csv. On the main interface, simply right on any one of the columns and select "column preference". This opens a new window which is very intuitive. Just add a new column and specify the field name. As simple as that.
I had tried tshark but trust me it becomes a bit annoying especially with this:
This message pops up if you include too many columns or for whatever unknown reason.
看起来您想要 Bro 的连接日志：
输出：
现在解析相关字段：
It looks like you want Bro's connection logs:
Output:
Now parse the relevant fields:
通过终端安装 argus
将 .pcap 转换为 .argus 文件格式
将 .argus 转换为 .csv 文件格式，同时选择要提取的功能
可以找到要打印的可用字段列表 此处
此信息是从我的原始博客复制的，您可以阅读此处
Install argus via terminal
Convert .pcap to .argus file format
Convert .argus to .csv file forrmat while choosing which features to extract
The list of available fields to print can be found here
This information is copied from my original blog which you can read here
您可以从 Wireshark 应用程序本身执行此操作：
File>Save)（如果您刚刚保存了文件）完成捕获）
File>Export Packet Dissesctions>as "CSV" [etc]这样做！）
瞧
You can do this from the Wireshark application itself:
File>Save) (if you have justdone a capture)
File>Export Packet Dissesctions>as "CSV" [etc]do this!)
Voila
这是将 pcap 划分为流并将提取的特征输出到 CSV 文件的 python 工具
尝试使用 python 中的 Flows_to_weka 工具
这需要在您的系统中安装 scapy 版本最好将 scapy 文件夹复制到 weka 文件夹中。并将 wfe.py、tcp_stream.py 和 entropy.py 文件复制到 scapy 文件夹中。完成此操作后
您当前的目录应如下所示：
将 .pcap 文件复制到此文件夹中并尝试运行此命令：
您还可以通过在 tcp_stream.py 和 wfe.py 中添加所需的功能来检索所需的功能。
作为参考，您可以访问：
https://github.com/fichtner/flows_to_weka
Here is the python tool to divide the pcap into flows and output the extracted features into a CSV file
Try using flows_to_weka tool in python
This requires a version of scapy installed in your system and better to copy the scapy folder inside the weka folder. And copy the wfe.py, tcp_stream.py and entropy.py files inside the scapy folder. After you done this
Your current directory should look something like this:
and copy the .pcap file into this folder and try running this command :
and you can also retrieve the features that you want by adding the required features in tcp_stream.py and wfe.py.
For reference you can visit :
https://github.com/fichtner/flows_to_weka
如问题评论中所述，要以 csv 格式输出捕获文件中帧的 IP 地址，请使用以下内容：
有关在 csv 输出中设置分隔符和引用字符的选项的更多信息，请参阅 tshark 帮助。
可以通过使用 Wireshark 检查捕获文件并在详细信息窗格中选择特定字段来确定字段名称。然后，字段名称将显示在 Wireshark 窗口底部的状态行中。
As noted in the comments to the question, to output the ip addresses for frames in a capture file in csv format use something like:
See the tshark help for more information about options to set the separator and quoting characters in the csv output.
Field names can be determined by using Wireshark to examine the capture file and selecting a particular field in the details pane. The field name will be then shown in the status line at the bottom of the Wireshark window.
我们是否可以设置除逗号之外的字段分隔符？
因为在我的 PCap 文件中，如果我设置分隔符 =，那么输出文件 (.csv) 中的数据看起来不太好，因为我的大多数列中都有 , 。
所以我想知道有什么方法可以像其他字符一样设置字段分隔符，即 | （点）等
谢谢
Is it possible that we can set fields separator other than comma ?
Because in my PCap file, if i set the separator=, then my data in output file (.csv) doesn't looks good because i have , in my most of the columns.
So i want to know that is there any way we can set the field separator like other charactors i.e., | (pip) etc
Thanks