Free online PCAP to CSV converter

A spreadsheet, reporting system, or script may require captured traffic as rows and columns instead of a binary packet trace. Converting the capture to CSV extracts selected fields for filtering, editing, sharing, or importing into Excel, LibreOffice Calc, Python, R, or a database.

What the PCAP format is

PCAP is a binary network-capture format that stores packet records, timestamps, captured and original lengths, a link-layer type, and captured bytes when available. The bytes may contain link, network, transport, and application data, depending on the capture point and snap length.

Wireshark, TShark, tcpdump, dumpcap, monitoring appliances, and intrusion-detection systems can create or write PCAP files. Network analysts use captures for troubleshooting, protocol analysis, performance investigations, incident response, and evidence preservation. The related PCAPNG format can also store multiple interfaces, comments, name-resolution data, and other capture metadata; current Wireshark and TShark versions generally read both formats.

Captures can contain credentials, cookies, IP addresses, messages, and other confidential payloads. Treat an unsanitized capture as sensitive evidence.

What the CSV format is

CSV is plain text organized into records and fields, usually with one record per line and commas separating fields. Quoting handles commas, quotation marks, and other characters inside field values, but CSV has no universal delimiter, encoding, or data-type standard.

A packet-summary CSV can contain frame number, timestamp, source and destination addresses, ports, protocol, and packet lengths. These columns are convenient for sorting, filtering, counting, charting, and database import, and the result is often much smaller than the original capture. CSV does not preserve the complete packet bytes, protocol hierarchy, reassembly state, capture metadata, comments, or analysis details that were not explicitly exported.

Using TShark

TShark is Wireshark’s command-line analyzer and gives repeatable control over the exported columns. Install Wireshark, or install the TShark package supplied by your operating system. Run the command from a terminal in the directory containing the capture:

tshark -r capture.pcap -n -T fields -E header=y -E separator=, -E quote=d -E occurrence=f -e frame.number -e frame.time_epoch -e ip.src -e ip.dst -e ipv6.src -e ipv6.dst -e tcp.srcport -e tcp.dstport -e udp.srcport -e udp.dstport -e _ws.col.Protocol -e frame.len -e frame.cap_len > packets.csv

-r reads the input, -n disables name resolution, and -T fields writes only the requested fields. The -E options add a header, select commas, quote values with double quotation marks, and keep the first value when a field occurs more than once. frame.len is the original on-wire length; frame.cap_len is the number of bytes captured. Replace capture.pcap with a .pcapng filename when necessary.

Fields that do not apply to a packet remain empty. For example, IP addresses are absent from non-IP traffic, and TCP ports are absent from UDP, ICMP, and other protocols. Add protocol-specific fields with additional -e options, such as dns.qry.name, http.request.method, tls.handshake.extensions_server_name, or tcp.stream. Use tshark -G fields to inspect field names supported by the installed version.

To export only packets matching a Wireshark display filter, add -Y:

tshark -r capture.pcap -n -Y "dns or tcp.port == 443" -T fields -E header=y -E separator=, -E quote=d -E occurrence=f -e frame.number -e frame.time_epoch -e ip.src -e ip.dst -e _ws.col.Protocol -e frame.len > filtered.csv

Use a shell-appropriate quoting style on Windows or another operating system if the filter contains special characters. TShark is preferable for large files, repeatable exports, and scripts because the schema is explicit.

Using Wireshark

1. Open the PCAP or PCAPNG file with File → Open.
2. Enter a display filter such as dns, http, ip.addr == 192.0.2.10, or tcp.port == 443.
3. Configure the packet-list columns through Edit → Preferences → Appearance → Columns if the default columns are not sufficient. Add fields such as packet number, time, source, destination, protocol, and length.
4. Choose File → Export Packet Dissections → As CSV. In the export dialog, select the displayed packets if the filter should limit the output.
5. Save the file with a .csv extension and inspect it in a text editor or controlled import before using it.

Wireshark’s graphical export is suitable for a one-time packet-list summary. Its output follows the packet-list columns, not every dissected field. Use TShark when exact field selection or repeatable batch processing is required.

Using the built-in online converter

You can convert the file on 101convert.com for free without installing software: upload the PCAP or PCAPNG file, choose CSV, start the conversion, and download the result. 

Quality and compatibility limits

• A short snap length may leave only headers or partial payloads in the capture. CSV cannot restore bytes that were never captured.
• Encryption normally leaves addresses, ports, timestamps, and protocol metadata available, but not decrypted application content.
• Repeated fields require a schema decision. -E occurrence=f keeps the first value; other occurrence settings can create repeated or separator-joined values that do not fit a simple database column.
• frame.time_epoch preserves a numeric Unix timestamp and fractional seconds more reliably than a locale-formatted time. Keep it when event ordering matters.
• Spreadsheet software may reinterpret timestamps, long integers, IP addresses, and values with leading zeros. Import columns with explicit text, integer, or date types when exact values matter.
• Large captures can produce millions of rows and exceed spreadsheet row limits. Filter before export, or load the CSV into a database, Python, R, or another data-processing tool.
• Retain the original PCAP or PCAPNG as the analysis source. CSV is a derived summary and is not sufficient for reliable packet reanalysis.