'frame.protocols': 'eth:ethertype:ip:tcp' 'frame.interface_description': 'Ethernet0' I just (TABED) the result above to make it easier to read, otherwise it is packed with, separation. So, I extracted a single packet, as per below and started experimenting with it, and the way to do it is that you can pick ANY expression between the ' ' and it should work, here is an example of a code I tried: tshark -N n -r file.pcapng -T fields -e frame.number -e ip.src -e ip.dst -e ip.proto -e frame.len -e eth.src_resolved -E header=y -E separator=, > file.txtĪnd here is the output of that packet extracted from the text file: frame.number,ip.src, ip.dst, ip.proto, frame.len, eth.src_resolvedġ, 248.79.112.255, 192.168.0.111, 6, 174, 00:0c:29:ef:e5:71

Just one note here, I am not sure this is how it meant to be or just a workaround Ok, after a couple of days of investigations, I came across a way to extract (or filter) the pcapng file to a text with any information available, what I have seen online so far is using the suffix _ws.col but this does not work with all the information available, except of the source IP, Destination IP, and Protocol, (almost) everything else will display empty field.

Arch wireshark