Richard Urwin wrote:
>It depends exactly what you want to do.
>
>If you want just the protocol summary, as displayed in the top pane of
>ethereal, then you can direct the output of tethereal to a file, and then
>import this file into Excel. On Excel 2000 the import function is hidden
>under "Tools->Edit Import Data". You need to use space seperated columns.
>
If you want to customize the default summary output by adding/removing some fields you can use the "-z proto,colinfo" option and/or "-o column.format" option (or change the column.format setting in the preference file). For more details see the tethereal man-page.
http://www.ethereal.com/lists/ethereal-users/200306/msg00152.html
Example:
tethereal -r infile.pcpap -t a -z "proto,colinfo,ip.id,ip.id" -z "proto,colinfo,ip.ttl,ip.ttl" -o "column.format: Frame, %m, time, %t, Proto, %p, Info, %i" > textfile.txt
The colinfo stuff is added last in the Info-field (e.g. as "ip.ttl == 43 ip.id == 0xa991"), so you may get some problems to get that data into the right column in the Excel sheet if you don't use e.g. some script to convert to a format that is more suitable.