=head1 SYNOPSIS
B<capinfos>
-S<[ B<-t> ]>
-S<[ B<-E> ]>
+S<[ B<-a> ]>
+S<[ B<-A> ]>
+S<[ B<-b> ]>
+S<[ B<-B> ]>
S<[ B<-c> ]>
-S<[ B<-s> ]>
+S<[ B<-C> ]>
S<[ B<-d> ]>
-S<[ B<-u> ]>
-S<[ B<-a> ]>
S<[ B<-e> ]>
-S<[ B<-y> ]>
-S<[ B<-i> ]>
-S<[ B<-z> ]>
-S<[ B<-x> ]>
+S<[ B<-E> ]>
+S<[ B<-h> ]>
S<[ B<-H> ]>
+S<[ B<-i> ]>
+S<[ B<-l> ]>
S<[ B<-L> ]>
-S<[ B<-T> ]>
-S<[ B<-R> ]>
-S<[ B<-r> ]>
-S<[ B<-B> ]>
S<[ B<-m> ]>
-S<[ B<-b> ]>
S<[ B<-N> ]>
+S<[ B<-o> ]>
S<[ B<-q> ]>
S<[ B<-Q> ]>
-S<[ B<-h> ]>
-S<[ B<-C> ]>
-S<[ B<-A> ]>
+S<[ B<-r> ]>
+S<[ B<-R> ]>
+S<[ B<-s> ]>
+S<[ B<-S> ]>
+S<[ B<-t> ]>
+S<[ B<-T> ]>
+S<[ B<-u> ]>
+S<[ B<-x> ]>
+S<[ B<-y> ]>
+S<[ B<-z> ]>
E<lt>I<infile>E<gt>
I<...>
is useful for generating a report that can be easily imported into
a spreadsheet or database.
-The user specifies what type of output (long or table) and which
-statistics to display by specifying flags (options) that corresponding
-to the report type and desired infos. If no options are specified,
+The user specifies what type of output (long or table) and which
+statistics to display by specifying flags (options) that corresponding
+to the report type and desired infos. If no options are specified,
B<Capinfos> will report all statistics available in "long" format.
-Options are processed from left to right order with later options
-superceeding or adding to earlier options.
+Options are processed from left to right order with later options
+superseding or adding to earlier options.
B<Capinfos> is able to detect and read the same capture files that are
supported by B<Wireshark>.
=over 4
-=item -t
+=item -a
-Displays the capture type of the capture file.
+Displays the start time of the capture. B<Capinfos> considers
+the earliest timestamp seen to be the start time, so the
+first packet in the capture is not necessarily the earliest -
+if packets exist "out-of-order", time-wise, in the capture,
+B<Capinfos> detects this.
-=item -E
+=item -A
-Displays the per-file encapsulation of the capture file.
+Generate all infos. By default capinfos will display
+all infos values for each input file, but enabling
+any of the individual display infos options will
+disable the generate all option.
+
+=item -b
+
+Separate infos with ASCII SPACE (0x20) characters.
+This option is only useful when generating a table
+style report (-T). The various info values will be
+separated (delimited) from one another with a single
+ASCII SPACE character.
+
+NOTE: Since some of the header labels as well as some
+of the value fields contain SPACE characters. This
+option is of limited value unless one of the quoting
+options (-q or -Q) is also specified.
+
+=item -B
+
+Separate the infos with ASCII TAB characters.
+This option is only useful when generating a table
+style report (-T). The various info values will be
+separated (delimited) from one another with a single
+ASCII TAB character. The TAB character is the default
+delimiter when -T style report is enabled.
=item -c
Displays the number of packets in the capture file.
-=item -s
+=item -C
-Displays the size of the file, in bytes. This reports
-the size of the capture file itself.
+Cancel processing any additional files if and
+when capinfos should fail to open an input file.
+By default capinfos will attempt to open each and
+every file name argument.
+
+Note: An error message will be written to stderr
+whenever capinfos fails to open a file regardless
+of whether the -C option is specified or not.
+Upon exit, capinfos will return an error status
+if any errors occurred during processing.
=item -d
were captured with a snaplen or other slicing option),
B<Capinfos> will consider the packet to have been 1514 bytes.
-=item -u
-
-Displays the capture duration, in seconds. This is the
-difference in time between the earliest packet seen and
-latest packet seen.
-
-=item -a
-
-Displays the start time of the capture. B<Capinfos> considers
-the earliest timestamp seen to be the start time, so the
-first packet in the capture is not necessarily the earliest -
-if packets exist "out-of-order", time-wise, in the capture,
-B<Capinfos> detects this.
-
=item -e
Displays the end time of the capture. B<Capinfos> considers
if packets exist "out-of-order", time-wise, in the capture,
B<Capinfos> detects this.
-=item -y
-
-Displays the average data rate, in bytes/sec
-
-=item -i
-
-Displays the average data rate, in bits/sec
-
-=item -z
+=item -E
-Displays the average packet size, in bytes
+Displays the per-file encapsulation of the capture file.
-=item -x
+=item -h
-Displays the average packet rate, in packets/sec
+Prints the help listing and exits.
=item -H
Displays the SHA1, RIPEMD160, and MD5 hashes for the file.
-=item -L
-
-Generate long report. Capinfos can generate two
-different styles of reports. The "long" report is
-the default style of output and is suitable for a
-human to use.
-
-=item -T
-
-Generate a table report. A table report is a text file
-that is suitable for importing into a spreadsheet or
-database. Capinfos can build a tab delimited text file
-(the default) or several variations on Comma-separated
-values (CSV) files.
-
-=item -R
+=item -i
-Generate header record. This option is only useful
-when generating a table style report (-T). A header
-is generated by default. A header record (if generated)
-is the first line of data reported and includes labels
-for all the columns included within the table report.
+Displays the average data rate, in bits/sec
+=item -l
-=item -r
+Display the snaplen (if any) for a file.
+snaplen (if available) is determined from the capture file header
+and by looking for truncated records in the capture file.
-Do not generate header record. This option is only
-useful when generating a table style report (-T).
-If this option is specified then B<no> header record will be
-generated within the table report.
+=item -o
+Displays "True" if packets exist in strict chronological order
+or "False" if one or more packets in the capture exists
+"out-of-order" time-wise.
-=item -B
+=item -L
-Separate the infos with ASCII TAB characters.
-This option is only useful when generating a table
-style report (-T). The various info values will be
-separated (delimited) from one another with a single
-ASCII TAB character. The TAB character is the default
-delimiter when -T style report is enabled.
+Generate long report. Capinfos can generate two
+different styles of reports. The "long" report is
+the default style of output and is suitable for a
+human to use.
-=item -m
+=item -m
-Separate the infos with comma (,) characters. This option
+Separate the infos with comma (,) characters. This option
is only useful when generating a table style report (-T).
The various info values will be separated (delimited)
from one another with a single comma "," character.
-=item -b
-
-Separate infos with ASCII SPACE (0x20) characters.
-This option is only useful when generating a table
-style report (-T). The various info values will be
-separated (delimited) from one another with a single
-ASCII SPACE character.
-
-NOTE: Since some of the header labels as well as some
-of the value fields contain SPACE characters. This
-option is of limited value unless one of the quoting
-options (-q or -Q) is also specified.
-
-=item -N
+=item -N
-Do not quote the infos. This option is only useful
-when generating a table style report (-T). Excluding
-any quoting characters around the various values and
-using a TAB delimiter produces a very "clean" table
-report that is easily parsed with CLI tools. By
+Do not quote the infos. This option is only useful
+when generating a table style report (-T). Excluding
+any quoting characters around the various values and
+using a TAB delimiter produces a very "clean" table
+report that is easily parsed with CLI tools. By
default infos are B<NOT> quoted.
+=item -q
-=item -q
-
-Quote infos with single quotes ('). This option is
+Quote infos with single quotes ('). This option is
only useful when generating a table style report (-T).
When this option is enabled, each value will be
-encapsulated within a pair of single quote (')
-characters. This option (when used with the -m
-option) is useful for generating one type of CSV
+encapsulated within a pair of single quote (')
+characters. This option (when used with the -m
+option) is useful for generating one type of CSV
style file report.
-=item -Q
+=item -Q
-Quote infos with double quotes ("). This option is
+Quote infos with double quotes ("). This option is
only useful when generating a table style report (-T).
When this option is enabled, each value will be
-encapsulated within a pair of double quote (")
-characters. This option (when used with the -m
+encapsulated within a pair of double quote (")
+characters. This option (when used with the -m
option) is useful for generating the most common
type of CSV style file report.
-=item -h
+=item -r
-Prints the help listing and exits.
+Do not generate header record. This option is only
+useful when generating a table style report (-T).
+If this option is specified then B<no> header record will be
+generated within the table report.
-=item -C
+=item -R
-Cancel processing any additional files if and
-when capinfos should fail to open an input file.
-By default capinfos will attempt to open each and
-every file name argument.
+Generate header record. This option is only useful
+when generating a table style report (-T). A header
+is generated by default. A header record (if generated)
+is the first line of data reported and includes labels
+for all the columns included within the table report.
-Note: An error message will be written to stderr
-whenever capinfos fails to open a file regardless
-of whether the -C option is specified or not.
+=item -s
+
+Displays the size of the file, in bytes. This reports
+the size of the capture file itself.
+
+=item -S
+
+Display the start and end times as seconds since January
+1, 1970. Handy for synchronizing dumps using B<editcap -t>.
+
+=item -t
+
+Displays the capture type of the capture file.
+
+=item -T
+
+Generate a table report. A table report is a text file
+that is suitable for importing into a spreadsheet or
+database. Capinfos can build a tab delimited text file
+(the default) or several variations on Comma-separated
+values (CSV) files.
+
+=item -u
+
+Displays the capture duration, in seconds. This is the
+difference in time between the earliest packet seen and
+latest packet seen.
+
+=item -x
-=item -A
+Displays the average packet rate, in packets/sec
-Generate all infos. By default capinfos will display
-all infos values for each input file, but enabling
-any of the individual display infos options will
-disable the generate all option.
+=item -y
+Displays the average data rate, in bytes/sec
+
+=item -z
+
+Displays the average packet size, in bytes
=back
capinfos -h
-To generate a long form report for the capture file
+To generate a long form report for the capture file
mycapture.pcap use:
- capinfos mycapture.pcap
+ capinfos mycapture.pcap
-To generate a TAB delimited table form report for the capture
+To generate a TAB delimited table form report for the capture
file mycapture.pcap use:
- capinfos -T mycapture.pcap
+ capinfos -T mycapture.pcap
-To generate a CSV style table form report for the capture
+To generate a CSV style table form report for the capture
file mycapture.pcap use:
- capinfos -T -m -Q mycapture.pcap
+ capinfos -T -m -Q mycapture.pcap
or
- capinfos -TmQ mycapture.pcap
+ capinfos -TmQ mycapture.pcap
-To generate a TAB delimited table style report with just the
-filenames, capture type, capture encapsulation type and packet
+To generate a TAB delimited table style report with just the
+filenames, capture type, capture encapsulation type and packet
count for all the pcap files in the current directory use:
capinfos -T -t -E -c *.pcap
-or
-
+or
+
capinfos -TtEs *.pcap
-Note: The ability to use of filename globbing characters are
-a feature of *nix style command shells.
+Note: The ability to use of filename globbing characters are
+a feature of *nix style command shells.
-To generate a CSV delimited table style report of all infos
-for all pcap files in the current directory and write it to
+To generate a CSV delimited table style report of all infos
+for all pcap files in the current directory and write it to
a text file called mycaptures.csv use:
capinfos -TmQ *.pcap >mycaptures.csv
-The resulting mycaptures.csv file can be easily imported
+The resulting mycaptures.csv file can be easily imported
into spreadsheet applications.
=head1 SEE ALSO
git.samba.org / obnox / wireshark / wip.git / blobdiff