1CAPINFOS(1)             The Wireshark Network Analyzer             CAPINFOS(1)
2
3
4

NAME

6       capinfos - Prints information about capture files
7

SYNOPSIS

9       capinfos [ -a ] [ -A ] [ -b ] [ -B ] [ -c ] [ -C ] [ -d ] [ -e ] [ -E ]
10       [ -h ] [ -H ] [ -i ] [ -l ] [ -L ] [ -m ] [ -M ] [ -N ] [ -o ] [ -q ]
11       [ -Q ] [ -r ] [ -R ] [ -s ] [ -S ] [ -t ] [ -T ] [ -u ] [ -x ] [ -y ]
12       [ -z ] <infile> ...
13

DESCRIPTION

15       Capinfos is a program that reads one or more capture files and returns
16       some or all available statistics (infos) of each <infile> in one of two
17       types of output formats: long or table.
18
19       The long output is suitable for a human to read.  The table output is
20       useful for generating a report that can be easily imported into a
21       spreadsheet or database.
22
23       The user specifies what type of output (long or table) and which
24       statistics to display by specifying flags (options) that corresponding
25       to the report type and desired infos.  If no options are specified,
26       Capinfos will report all statistics available in "long" format.
27
28       Options are processed from left to right order with later options
29       superseding or adding to earlier options.
30
31       Capinfos is able to detect and read the same capture files that are
32       supported by Wireshark.  The input files don't need a specific filename
33       extension; the file format and an optional gzip compression will be
34       automatically detected.  Near the beginning of the DESCRIPTION section
35       of wireshark(1) or
36       <http://www.wireshark.org/docs/man-pages/wireshark.html> is a detailed
37       description of the way Wireshark handles this, which is the same way
38       Capinfos handles this.
39

OPTIONS

41       -a  Displays the start time of the capture.  Capinfos considers the
42           earliest timestamp seen to be the start time, so the first packet
43           in the capture is not necessarily the earliest - if packets exist
44           "out-of-order", time-wise, in the capture, Capinfos detects this.
45
46       -A  Generate all infos. By default capinfos will display all infos
47           values for each input file, but enabling any of the individual
48           display infos options will disable the generate all option.
49
50       -b  Separate infos with ASCII SPACE (0x20) characters.  This option is
51           only useful when generating a table style report (-T).  The various
52           info values will be separated (delimited) from one another with a
53           single ASCII SPACE character.
54
55           NOTE: Since some of the header labels as well as some of the value
56           fields contain SPACE characters.  This option is of limited value
57           unless one of the quoting options (-q or -Q) is also specified.
58
59       -B  Separate the infos with ASCII TAB characters.  This option is only
60           useful when generating a table style report (-T).  The various info
61           values will be separated (delimited) from one another with a single
62           ASCII TAB character.  The TAB character is the default delimiter
63           when -T style report is enabled.
64
65       -c  Displays the number of packets in the capture file.
66
67       -C  Cancel processing any additional files if and when capinfos should
68           fail to open an input file.  By default capinfos will attempt to
69           open each and every file name argument.
70
71           Note: An error message will be written to stderr whenever capinfos
72           fails to open a file regardless of whether the -C option is
73           specified or not.  Upon exit, capinfos will return an error status
74           if any errors occurred during processing.
75
76       -d  Displays the total length of all packets in the file, in bytes.
77           This counts the size of the packets as they appeared in their
78           original form, not as they appear in this file.  For example, if a
79           packet was originally 1514 bytes and only 256 of those bytes were
80           saved to the capture file (if packets were captured with a snaplen
81           or other slicing option), Capinfos will consider the packet to have
82           been 1514 bytes.
83
84       -e  Displays the end time of the capture.  Capinfos considers the
85           latest timestamp seen to be the end time, so the last packet in the
86           capture is not necessarily the latest - if packets exist "out-of-
87           order", time-wise, in the capture, Capinfos detects this.
88
89       -E  Displays the per-file encapsulation of the capture file.
90
91       -h  Prints the help listing and exits.
92
93       -H  Displays the SHA1, RIPEMD160, and MD5 hashes for the file.
94
95       -i  Displays the average data rate, in bits/sec
96
97       -k  Displays the capture comment. For pcapng files, this is the comment
98           from the section header block.
99
100       -l  Display the snaplen (if any) for a file.  snaplen (if available) is
101           determined from the capture file header and by looking for
102           truncated records in the capture file.
103
104       -L  Generate long report.  Capinfos can generate two different styles
105           of reports.  The "long" report is the default style of output and
106           is suitable for a human to use.
107
108       -m  Separate the infos with comma (,) characters.  This option is only
109           useful when generating a table style report (-T).  The various info
110           values will be separated (delimited) from one another with a single
111           comma "," character.
112
113       -M  Print raw (machine readable) numeric values in long reports.  By
114           default capinfos prints human-readable values with SI suffixes.
115           Table reports (-T) always print raw values.
116
117       -N  Do not quote the infos.  This option is only useful when generating
118           a table style report (-T).  Excluding any quoting characters around
119           the various values and using a TAB delimiter produces a very
120           "clean" table report that is easily parsed with CLI tools.  By
121           default infos are NOT quoted.
122
123       -o  Displays "True" if packets exist in strict chronological order or
124           "False" if one or more packets in the capture exists "out-of-order"
125           time-wise.
126
127       -q  Quote infos with single quotes ('). This option is only useful when
128           generating a table style report (-T).  When this option is enabled,
129           each value will be encapsulated within a pair of single quote (')
130           characters.  This option (when used  with the -m option) is useful
131           for generating one type of CSV style file report.
132
133       -Q  Quote infos with double quotes (").  This option is only useful
134           when generating a table style report (-T).  When this option is
135           enabled, each value will be encapsulated within a pair of double
136           quote (") characters.  This option (when used with the -m option)
137           is useful for generating the most common type of CSV style file
138           report.
139
140       -r  Do not generate header record.  This option is only useful when
141           generating a table style report (-T).  If this option is specified
142           then no header record will be generated within the table report.
143
144       -R  Generate header record.  This option is only useful when generating
145           a table style report (-T).  A header is generated by default.  A
146           header record (if generated) is the first line of data reported and
147           includes labels for all the columns included within the table
148           report.
149
150       -s  Displays the size of the file, in bytes.  This reports the size of
151           the capture file itself.
152
153       -S  Display the start and end times as seconds since January 1, 1970.
154           Handy for synchronizing dumps using editcap -t.
155
156       -t  Displays the capture type of the capture file.
157
158       -T  Generate a table report. A table report is a text file that is
159           suitable for importing into a spreadsheet or database.  Capinfos
160           can build a tab delimited text file (the default) or several
161           variations on Comma-separated values (CSV) files.
162
163       -u  Displays the capture duration, in seconds.  This is the difference
164           in time between the earliest packet seen and latest packet seen.
165
166       -x  Displays the average packet rate, in packets/sec
167
168       -y  Displays the average data rate, in bytes/sec
169
170       -z  Displays the average packet size, in bytes
171

EXAMPLES

173       To see a description of the capinfos options use:
174
175           capinfos -h
176
177       To generate a long form report for the capture file mycapture.pcap use:
178
179           capinfos mycapture.pcap
180
181       To generate a TAB delimited table form report for the capture file
182       mycapture.pcap use:
183
184           capinfos -T mycapture.pcap
185
186       To generate a CSV style table form report for the capture file
187       mycapture.pcap use:
188
189           capinfos -T -m -Q mycapture.pcap
190
191       or
192
193           capinfos -TmQ mycapture.pcap
194
195       To generate a TAB delimited table style report with just the filenames,
196       capture type, capture encapsulation type and packet count for all the
197       pcap files in the current directory use:
198
199           capinfos -T -t -E -c *.pcap
200
201       or
202
203           capinfos -TtEs *.pcap
204
205       Note: The ability to use of filename globbing characters are a feature
206       of *nix style command shells.
207
208       To generate a CSV delimited table style report of all infos for all
209       pcap files in the current directory and write it to a text file called
210       mycaptures.csv use:
211
212           capinfos -TmQ *.pcap >mycaptures.csv
213
214       The resulting mycaptures.csv file can be easily imported into
215       spreadsheet applications.
216

SEE ALSO

218       pcap(3), wireshark(1), mergecap(1), editcap(1), tshark(1), dumpcap(1),
219       pcap-filter(7) or tcpdump(8)
220

NOTES

222       Capinfos is part of the Wireshark distribution.  The latest version of
223       Wireshark can be found at <http://www.wireshark.org>.
224
225       HTML versions of the Wireshark project man pages are available at:
226       <http://www.wireshark.org/docs/man-pages>.
227

AUTHORS

229         Original Author
230         -------- ------
231         Ian Schorr           <ian[AT]ianschorr.com>
232
233
234         Contributors
235         ------------
236         Gerald Combs         <gerald[AT]wireshark.org>
237         Jim Young            <jyoung[AT]gsu.edu>
238
239
240
2411.10.14                           2015-05-12                       CAPINFOS(1)
Impressum