Get info from a packet capture
1 min |  Ross Jacobs |  May 5, 2019

Table of Contents

Quicklinks: Capinfos: manpage | Wireshark Docs | code


capinfos gets metadata about a packet capture. You can be very granular about what pieces of data you want displayed and the output format.

General Usage

To see infos a list, use capinfos <file>, as list is the default. To see infos as a table, use capinfos -T <file>. Note that the tabular format skips presentation of interface info. These tabular options can help with parsing in a scripting language:


capinfos offers 22 options -acdDeEFHiIkKlnosStuxyz to print specific elements. My perspective is that it is better to use a scripting language to convert all of the infos (no options) into a reusable format. It’s fairly straightforward to parse capinfos <file> into a hash table in your $language.

Feel free to use parsers I have in 2 languages:

  • Python: See get_capinfos()
  • Go: See GetCapinfos()