Wireshark capture file text filter

Question

I'm looking for a Windows or Linux program that can filter text strings out of the user data fields of a Wireshark capture file.

I am writing a program to communicate with an embedded computer using an undocumented TCP/IP link. I can capture messages being sent in each direction by existing equipment and I can see they are purely ASCII text. But its hard to see the exchanges at a glance within the default Wireshark view where I have to scroll through the messages one at a time to see the user data. I need to see just the text of the messages.

Essential features

• Free
• Runs under Windows 10 or Ubuntu
• Opens a Wireshark .pcapng file
• For TCP packets with any ASCII user data writes out the ascii data
• Ignores packets with no ascii user data

Nice to have features

• Wireshark like filters for IP addresses
• There can be multiple messages separated by CR or LF or both in a single packet, an output of one message per line preceded by the originator's IP address would be great

Answer 1

You do not actually need another piece of software to do this. You can use wiresharks built in find packet tool. To do this go to edit and then click on find packet.

in the filter section type in the string that you want to search for. In the by part you need to select string to search for a string. You will probably want to leave case sensitive unchecked unless you want to search for a case sensitive string. the direction just changes which way it will search. So if you have the top packet selected and you go down it will find the first packet with that string down from the original packet you had selected. Then press find and it will find a packet. To find the next packet click find again.