Question

Please provide commands to open an 8GB pcap file with tshark. Wireshark cannot open the file because it is too large thus tshark must be used. Tshark runs commands from the terminal.

Please do not answer if you are not sure which command to use. I need the pcap file transferred into a text file with all information/packets. Again the file extension is .pcap

Answer 1

Here the command used to read the pcap file is ::

tshark -r <YOUR_PCAP_FILE_NAME>.

In this case,my file name is traffic pcap.

-r stands for read.

Output of the above command ::

And now I am transferring the content of pcap into an txt file. Using the following command shown in the below picture ::

> indicates that to move the content of pcap file to the txt file.

And here is the output of the above command ::

cat is the command used to read the contents of the file and print it.