I want to convert a pcap file to csv/tsv with "Tshark" where each line corresponds to a packet and have the following format: timestamp src_ip dst_ip protocol
I use this command: tshark -r <file_name.pcap> -T fields -e frame.time_epoch -e ip.src -e ip.dst -e ip.proto
However, in the displayed output I see some lines to have two src,dst IP addresses and protocol number like this: 1525794300.3842 92.153.107.1,203.46.108.229 203.46.108.229,85.50.172.78 1,1
While for the rest, each line has one src IP, one dst IP and one protocol like the following:
1525794300.3843 185.61.46.124 163.218.99.213 6
Is there any reason that tshark is displaying multiple src and dst ip addresses in a single line? Can we do something so tshark does not do this?
Thanks!
The reason tshark displays multiple src and dst IP addresses as well as multiple protocol numbers is because there are multiple IP headers in the packet. In this case, it's ICMP packet carrying information about another ICMP packet, perhaps a "Time to live exceeded in transit" or some other such error. If you open the file in Wireshark or run tshark -r <file_name.pcap> -Y "icmp", you will be able to see this for yourself.
If you're only interested in the first (outer) IP src and dst addresses and protocol number, then you can limit the output to the first occurrence of each field as follows:
tshark -r <file_name.pcap> -T fields -E occurrence=f -e frame.time_epoch -e ip.src -e ip.dst -e ip.proto
Alternatively, you can specify columns while limiting the field occurrences this way:
On *nix:
tshark -r <file_name.pcap> -o 'gui.column.format:"Epoch Time","%Cus:frame.time_epoch","Src","%Cus:ip.src:1","Dst","%Cus:ip.dst:1","Proto","%Cus:ip.proto:1"'
On Windows:
tshark.exe -r <file_name.pcap> -o "gui.column.format:\"Epoch Time\",\"%Cus:frame.time_epoch\",\"Src\",\"%Cus:ip.src:1\",\"Dst\",\"%Cus:ip.dst:1\",\"Proto\",\"%Cus:ip.proto:1\""
Run tshark -G column-formats for additional help with the column formats.