Easiest way to convert pcap to JSON

Question

I have a bunch of pcap files, created with tcpdump. I would like to store these in a database, for easier querying, indexing etc. I thought mongodb might be a good choice, because storing a packet the way Wireshark/TShark presents them as JSON document seems to be natural.

It should be possible to create PDML files with tshark, parse these and insert them into mongodb, but I am curious if someone knows of an existing/other solution.

Solution 1

On the command line (Linux, Windows or MacOS), you can use tshark.

e.g.

tshark -r input.pcap -T json >output.json

or with a filter:

tshark -2 -R "your filter" -r input.pcap -T json >output.json

Considering you mentioned a set of pcap files, you can also pre-merge the pcap files into a single pcap and then export that in one go if preferred..

mergecap -w output.pcap input1.pcap input2.pcap.. 

Solution 2

Wireshark has a feature to export it's capture files to JSON.

File->Export Packet Dissections->As JSON

Solution 3

You could use pcaphar. More info about HAR here.

Comments

[bright-star]

This answer is pretty much just links which are vulnerable to rot.

[nealmcb]

What version is this supported in?