How to read pcap files directly using matlab

Hi,

I have to extract statistical features like source port, destination port, packet length, total length and round trip time from .pcap files by using Matlab. I tried some widespread ways I found on the Internet (pcap2matlab, traceplay) but I didn't make them work. Is there anyone who has a new suggestion? I will really appreciate your help.

Regards,

Asli

Answer 1

[Samatha Aleti]

Hi Aslihan,

There is no such feature as of now, but it will be considered for a future release. Also, 'pcap2matlab' is one of the submissions in MATLAB File Exchange on MATLAB Central which is a forum for our product users to interact, exchange information and knowledge, without MathWorks' involvement.

Feel free to contact the author of this submission directly for specific questions about the implementation.

[Aslihan Reyhanoglu]

Hi Samantha,

Thank you for your answer. I'll contact the author.

Answer 2

[michael]

To make the pcap2matlab litlle bit simple to use:

capture = pcap2matlab(filter, decodeas_and_dissector, filename_or_interface, capture_stop_criteria)

Lets say you are using a udp protocol and the data you would like to read is on top of it: data[0:1] (in packet showed below is 0x5d 0x2d)

Therfore in order to read a file you shall use:

• filter=[]; %there is no specific filter
• decodeas_and_dissector.somedata=base+0:base+1; (where base is the location of the 1st byte of the data (0x2a=42))
• capture_stop_criteria=[];

Now, lets assume that your data is dissected, like udp.srcport,

Therfore in order to read a file you may use:

• decodeas_and_dissector = {'udp.srcport'}

other option is like before

• decodeas_and_dissector.srcport = 34:35 %locations (0x22:0x23)

[Bram Surewaard]

I tried to use your explanaition but i think i dont have a good enough understanding to make it work.

I have a pcap file that consists of different frames of sonar data, from which i want to use the range measurements in matlab. This is what the pcap file looks like:

I would like to work with the data from that is in Range Data and Angles (equi-angle) but I cannot figure out how to extract this data with the pcap2matlab command, could you maybe help me? It would be really nice if you could help me with this as I have been stuck on it for pretty long.

Thanks!

[michael]

What the command you are issueing?

What are the parameters for this command?

[Bram Surewaard]

Yeah that is the problem, i have no idea what kind of input would make sense and how I find this out.

I dont have the right knowledge of this kind of data and how to work with it.

Do you have any suggestions on what kind of commands I should use?

It would really help me out if you where able to help me!

These are the files I am working with:

Data https://gofile.io/d/3UnV8S

Dissector https://gofile.io/d/bCXBDG

[Huy Nguyen Duc]

Hello @michael, I am trying to use the function as you instructed and I met this issue:

Is there anyway to fix this issue?

Thank you, Huy Nguyen.

[Neeraj Pal]

find and replace tshark -r with "c:\program files\wireshark\tshark" -r

[Buns Cutie]

hello, I'm a senior from China. I have met some problems when I used above code, like following picture. I want to read a wireshark packet(.pcapng) to analysis it's feature. How should I do? Thanks for everyone.

capture = pcap2matlab([],[],'gigE_image.pcapng',[]);
Started reading captured file:
Started importing to MATLAB:
错误使用 fieldnames
'double' 类型的输入参数无效。输入必须为结构体或者 Java 或 COM 对象。

出错 pcap2matlab (第 210 行)
FieldsofDissector = fieldnames(decodeas_and_dissector);

[Marek HICAR]

Got an error:

'tshark' is not recognized as an internal or external command,

operable program or batch file

pcap2matlab([], 'udp.srcport==2451', 'data.pcap', []);

Can you clarify?

[Walter Roberson]

You need to install WireShark https://www.wireshark.org/download.html . The pcap2matlab() code invokes an executable named tshark from the wireshark installation.

[Marek HICAR]

Thanks Walter, I do have WireShark installed before launching the pcap2matlab file.

The file was recordered. Are the input arguments correct? See attached fig.