1CAPINFOS(1)             The Wireshark Network Analyzer             CAPINFOS(1)
2
3
4

NAME

6       capinfos - Prints information about capture files
7

SYNOPSIS

9       capinfos [ -a ] [ -A ] [ -b ] [ -B ] [ -c ] [ -C ] [ -d ] [ -e ] [ -E ]
10       [ -h ] [ -H ] [ -i ] [ -l ] [ -L ] [ -m ] [ -N ] [ -o ] [ -q ] [ -Q ]
11       [ -r ] [ -R ] [ -s ] [ -S ] [ -t ] [ -T ] [ -u ] [ -x ] [ -y ] [ -z ]
12       <infile> ...
13

DESCRIPTION

15       Capinfos is a program that reads one or more capture files and returns
16       some or all available statistics (infos) of each <infile> in one of two
17       types of output formats: long or table.
18
19       The long output is suitable for a human to read.  The table output is
20       useful for generating a report that can be easily imported into a
21       spreadsheet or database.
22
23       The user specifies what type of output (long or table) and which
24       statistics to display by specifying flags (options) that corresponding
25       to the report type and desired infos.  If no options are specified,
26       Capinfos will report all statistics available in "long" format.
27
28       Options are processed from left to right order with later options
29       superseding or adding to earlier options.
30
31       Capinfos is able to detect and read the same capture files that are
32       supported by Wireshark.  The input files don't need a specific filename
33       extension; the file format and an optional gzip compression will be
34       automatically detected.  Near the beginning of the DESCRIPTION section
35       of wireshark(1) or
36       <http://www.wireshark.org/docs/man-pages/wireshark.html> is a detailed
37       description of the way Wireshark handles this, which is the same way
38       Capinfos handles this.
39

OPTIONS

41       -a  Displays the start time of the capture.  Capinfos considers the
42           earliest timestamp seen to be the start time, so the first packet
43           in the capture is not necessarily the earliest - if packets exist
44           "out-of-order", time-wise, in the capture, Capinfos detects this.
45
46       -A  Generate all infos. By default capinfos will display all infos
47           values for each input file, but enabling any of the individual
48           display infos options will disable the generate all option.
49
50       -b  Separate infos with ASCII SPACE (0x20) characters.  This option is
51           only useful when generating a table style report (-T).  The various
52           info values will be separated (delimited) from one another with a
53           single ASCII SPACE character.
54
55           NOTE: Since some of the header labels as well as some of the value
56           fields contain SPACE characters.  This option is of limited value
57           unless one of the quoting options (-q or -Q) is also specified.
58
59       -B  Separate the infos with ASCII TAB characters.  This option is only
60           useful when generating a table style report (-T).  The various info
61           values will be separated (delimited) from one another with a single
62           ASCII TAB character.  The TAB character is the default delimiter
63           when -T style report is enabled.
64
65       -c  Displays the number of packets in the capture file.
66
67       -C  Cancel processing any additional files if and when capinfos should
68           fail to open an input file.  By default capinfos will attempt to
69           open each and every file name argument.
70
71           Note: An error message will be written to stderr whenever capinfos
72           fails to open a file regardless of whether the -C option is
73           specified or not.  Upon exit, capinfos will return an error status
74           if any errors occurred during processing.
75
76       -d  Displays the total length of all packets in the file, in bytes.
77           This counts the size of the packets as they appeared in their
78           original form, not as they appear in this file.  For example, if a
79           packet was originally 1514 bytes and only 256 of those bytes were
80           saved to the capture file (if packets were captured with a snaplen
81           or other slicing option), Capinfos will consider the packet to have
82           been 1514 bytes.
83
84       -e  Displays the end time of the capture.  Capinfos considers the
85           latest timestamp seen to be the end time, so the last packet in the
86           capture is not necessarily the latest - if packets exist "out-of-
87           order", time-wise, in the capture, Capinfos detects this.
88
89       -E  Displays the per-file encapsulation of the capture file.
90
91       -h  Prints the help listing and exits.
92
93       -H  Displays the SHA1, RIPEMD160, and MD5 hashes for the file.
94
95       -i  Displays the average data rate, in bits/sec
96
97       -l  Display the snaplen (if any) for a file.  snaplen (if available) is
98           determined from the capture file header and by looking for
99           truncated records in the capture file.
100
101       -L  Generate long report.  Capinfos can generate two different styles
102           of reports.  The "long" report is the default style of output and
103           is suitable for a human to use.
104
105       -m  Separate the infos with comma (,) characters.  This option is only
106           useful when generating a table style report (-T).  The various info
107           values will be separated (delimited) from one another with a single
108           comma "," character.
109
110       -N  Do not quote the infos.  This option is only useful when generating
111           a table style report (-T).  Excluding any quoting characters around
112           the various values and using a TAB delimiter produces a very
113           "clean" table report that is easily parsed with CLI tools.  By
114           default infos are NOT quoted.
115
116       -o  Displays "True" if packets exist in strict chronological order or
117           "False" if one or more packets in the capture exists "out-of-order"
118           time-wise.
119
120       -q  Quote infos with single quotes ('). This option is only useful when
121           generating a table style report (-T).  When this option is enabled,
122           each value will be encapsulated within a pair of single quote (')
123           characters.  This option (when used  with the -m option) is useful
124           for generating one type of CSV style file report.
125
126       -Q  Quote infos with double quotes (").  This option is only useful
127           when generating a table style report (-T).  When this option is
128           enabled, each value will be encapsulated within a pair of double
129           quote (") characters.  This option (when used with the -m option)
130           is useful for generating the most common type of CSV style file
131           report.
132
133       -r  Do not generate header record.  This option is only useful when
134           generating a table style report (-T).  If this option is specified
135           then no header record will be generated within the table report.
136
137       -R  Generate header record.  This option is only useful when generating
138           a table style report (-T).  A header is generated by default.  A
139           header record (if generated) is the first line of data reported and
140           includes labels for all the columns included within the table
141           report.
142
143       -s  Displays the size of the file, in bytes.  This reports the size of
144           the capture file itself.
145
146       -S  Display the start and end times as seconds since January 1, 1970.
147           Handy for synchronizing dumps using editcap -t.
148
149       -t  Displays the capture type of the capture file.
150
151       -T  Generate a table report. A table report is a text file that is
152           suitable for importing into a spreadsheet or database.  Capinfos
153           can build a tab delimited text file (the default) or several
154           variations on Comma-separated values (CSV) files.
155
156       -u  Displays the capture duration, in seconds.  This is the difference
157           in time between the earliest packet seen and latest packet seen.
158
159       -x  Displays the average packet rate, in packets/sec
160
161       -y  Displays the average data rate, in bytes/sec
162
163       -z  Displays the average packet size, in bytes
164

EXAMPLES

166       To see a description of the capinfos options use:
167
168           capinfos -h
169
170       To generate a long form report for the capture file mycapture.pcap use:
171
172           capinfos mycapture.pcap
173
174       To generate a TAB delimited table form report for the capture file
175       mycapture.pcap use:
176
177           capinfos -T mycapture.pcap
178
179       To generate a CSV style table form report for the capture file
180       mycapture.pcap use:
181
182           capinfos -T -m -Q mycapture.pcap
183
184       or
185
186           capinfos -TmQ mycapture.pcap
187
188       To generate a TAB delimited table style report with just the filenames,
189       capture type, capture encapsulation type and packet count for all the
190       pcap files in the current directory use:
191
192           capinfos -T -t -E -c *.pcap
193
194       or
195
196           capinfos -TtEs *.pcap
197
198       Note: The ability to use of filename globbing characters are a feature
199       of *nix style command shells.
200
201       To generate a CSV delimited table style report of all infos for all
202       pcap files in the current directory and write it to a text file called
203       mycaptures.csv use:
204
205           capinfos -TmQ *.pcap >mycaptures.csv
206
207       The resulting mycaptures.csv file can be easily imported into
208       spreadsheet applications.
209

SEE ALSO

211       pcap(3), wireshark(1), mergecap(1), editcap(1), tshark(1), dumpcap(1),
212       pcap-filter(7) or tcpdump(8) if it doesn't exist
213

NOTES

215       Capinfos is part of the Wireshark distribution.  The latest version of
216       Wireshark can be found at <http://www.wireshark.org>.
217
218       HTML versions of the Wireshark project man pages are available at:
219       <http://www.wireshark.org/docs/man-pages>.
220

AUTHORS

222         Original Author
223         -------- ------
224         Ian Schorr           <ian[AT]ianschorr.com>
225
226
227         Contributors
228         ------------
229         Gerald Combs         <gerald[AT]wireshark.org>
230         Jim Young            <jyoung[AT]gsu.edu>
231
232
233
2341.8.10                            2012-06-05                       CAPINFOS(1)
Impressum