What is the best way to extract only hex value for all fields to JSON with Wireshark/TShark

Question

I want to get information I have with Wireshark (the GUI), the information I want are for each packets its layers with all fields and their hexadecimal values. I want to get it to transform each packet into a JSON with this structure:

{
    "pcap_file": pcap_file,
    "number": paquet number (this first column in Wireshark GUI),
    "sniff_time" : sniff time
    "layers": { 
        layer_name: {
            field_name: field's raw value,
            .......
        },
        ......
    ]
}

I tried while few hours to do with the pyshark library in python. I almost done it but the thing is sometimes I don't have some information about the last layer.

For example for a LDAP packet with in the LDAP layer two fields "SASL Buffer Length" and "SASL Buffer" I had only the "SASL Buffer". So for this example I could build "SASL Buffer" using the layer's raw data on subtract "SASL BUffer Length"'s raw data. But with a lot of other examples with more missing fields, I couldn't because this library doesn't provide the order of fields.

So I'm wondering if there is a way to have all this information (all fields, with their order and their raw values, and for each layer) as we have in the GUI.

I saw there is maybe these ways:

-Write a C++ program and use tshark and use JSON option

-Write a Lua script to dissect packet

-Export data as JSON

But honestly I'm pretty lost, for all documentation/answers I did read, I don't see way to get raw values as I want and have with the GUI

score 1 · Answer 1 · edited Aug 02 '23 at 07:56

I found a way to have what I need:

tshark -T pdml -r your_pcap > your_pcap.pdml

The thing is tshark will give a lot of information so for those who want to do like me, you have to do a script to filter information you only want. Indeed it's impossible according to documentation to select information we want keep when we use -T pdml option (or I didn't see it ahah)

Also for a 100MB pcap, I had a 2.8GB pdml file so if you have big pcap, think about split it into smaller pcaps with editcap

What is the best way to extract only hex value for all fields to JSON with Wireshark/TShark

1 Answers1