Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
CAPINFOS(1)							     CAPINFOS(1)

NAME
     capinfos - Prints information about capture files

SYNOPSIS
     capinfos  [  -a  ]  [ -A ] [ -b ] [ -B ] [ -c ] [ -C ] [ -d ] [ -D ] [ -e ]
     [ -E ] [ -F ] [ -h ] [ -H ] [ -i ] [ -I ] [ -k ] [ -K ]  [  -l  ]	[  -L  ]
     [	-m  ]  [  -M  ]  [ -n ] [ -N ] [ -o ] [ -p ] [ -P ] [ -q ] [ -Q ] [ -r ]
     [ -R ] [ -s ] [ -S ] [ -t ] [ -T ] [ -u ] [ -v ] [ -x ] [ -y ] [ -z ]  <in-
     file> ...

     capinfos -h|--help

     capinfos -v|--version

DESCRIPTION
     Capinfos is a program that reads one or more capture files and returns some
     or all available statistics (infos) of each <infile> in one of two types of
     output formats: long or table.

     The long output is suitable for a human to read. The table output is useful
     for  generating  a report that can be easily imported into a spreadsheet or
     database.

     The user specifies what type of output (long or table) and which statistics
     to display by specifying flags (options) that corresponding to  the  report
     type  and	desired infos. If no options are specified, Capinfos will report
     all statistics available in "long" format.

     Options are processed from left to right order with later options supersed-
     ing or adding to earlier options.

     Capinfos is able to detect and read the same capture files  that  are  sup-
     ported  by Wireshark. The input files don't need a specific filename exten-
     sion; the file format and an optional gzip, zstd or lz4 compression will be
     automatically detected. Near the beginning of the	DESCRIPTION  section  of
     wireshark(1) or https://www.wireshark.org/docs/man-pages/wireshark.html is
     a detailed description of the way Wireshark handles this, which is the same
     way Capinfos handles this.

OPTIONS
     -a
	 Displays  the timestamp of the earliest packet in the capture. The ear-
	 liest packet in the capture is not necessarily the first packet in  the
	 capture  -  if packets exist "out-of-order", time-wise, in the capture,
	 Capinfos detects this.

     -A
	 Generate all infos. By default Capinfos will display all  infos  values
	 for  each  input file, but enabling any of the individual display infos
	 options will disable the generate all option.

     -b

	 Separate infos with ASCII SPACE (0x20) characters. This option is  only
	 useful when generating a table style report (-T). The various info val-
	 ues  will be separated (delimited) from one another with a single ASCII
	 SPACE character.

	     Note

	     Since some of the header labels as well as some of the value fields
	     contain SPACE characters. This option is of  limited  value  unless
	     one of the quoting options (-q or -Q) is also specified.

     -B
	 Separate  the infos with ASCII TAB characters. This option is only use-
	 ful when generating a table style report (-T). The various info  values
	 will  be separated (delimited) from one another with a single ASCII TAB
	 character. The TAB character is the default delimiter when -T style re-
	 port is enabled.

     -c
	 Displays the number of packets in the capture file.

     -C

	 Cancel processing any additional files if and when  Capinfos  fails  to
	 open  an  input file or gets an error reading an input file. By default
	 Capinfos will continue processing files even if it gets an error  open-
	 ing or reading a file.

	 Note:	An  error  message  will  be written to stderr whenever Capinfos
	 fails to open a file or gets an error reading from  a	file  regardless
	 whether the -C option is specified or not. Upon exit, Capinfos will re-
	 turn an error status if any errors occurred during processing.

     -d
	 Displays  the	total  length of all packets in the file, in bytes. This
	 counts the size of the packets as they appeared in their original form,
	 not as they appear in this file. For example, if a  packet  was  origi-
	 nally	1514 bytes and only 256 of those bytes were saved to the capture
	 file (if packets were captured with a snaplen or other slicing option),
	 Capinfos will consider the packet to have been 1514 bytes.

     -D
	 Displays a count of the number of decryption secrets in the file.  This
	 information is not available in table format.

     -e
	 Displays  the timestamp of the latest packet in the capture. The latest
	 packet in the capture is not necessarily the last packet in the capture

	 *   if packets exist "out-of-order", time-wise, in the capture,  Capin-
	     fos detects this.

     -E
	 Displays the per-file encapsulation of the capture file.

     -F
	 Displays additional capture file information.

     -h|--help
	 Print the version number and options and exit.

     -H
	 Displays  the	SHA256	and SHA1 hashes for the file. SHA1 output may be
	 removed in the future.

     -i
	 Displays the average data rate, in bits/sec

     -I
	 Displays detailed capture file interface information. This  information
	 is not available in table format.

     -k
	 Displays  the	capture  comment.  For pcapng files, this is the comment
	 from the section header block.

     -K
	 Use this option to suppress printing capture comments. By default  cap-
	 ture comments are enabled. Capture comments are relatively freeform and
	 might	contain  embedded  new-line  characters  and/or other delimiting
	 characters making it harder for a human or machine to easily parse  the
	 Capinfos  output. Excluding capture comments can aid in post-processing
	 of output.

     -l
	 Display the snaplen (if any) for a file. snaplen (if available) is  de-
	 termined  from  the  capture  file  header and by looking for truncated
	 records in the capture file.

     -L
	 Generate long report. Capinfos can generate two different styles of re-
	 ports. The "long" report is the default style of output and is suitable
	 for a human to use.

     -m
	 Separate the infos with comma (,) characters. This option is only  use-
	 ful  when generating a table style report (-T). The various info values
	 will be separated (delimited) from one another with a single comma  ","
	 character.

     -M
	 Print	raw (machine readable) values in long reports. By default Capin-
	 fos prints numeric values with human-readable SI  suffixes,  and  shows
	 human-readable  file  type and encapsulation. Table reports (-T) always
	 print raw values.

     -n
	 Displays a count of the number of resolved IPv4 addresses and	a  count
	 of  the number of resolved IPv6 addresses in the file. This information
	 is not available in table format.

     -N
	 Do not quote the infos. This option is only useful  when  generating  a
	 table	style  report  (-T). Excluding any quoting characters around the
	 various values and using a TAB delimiter produces a very "clean"  table
	 report  that  is easily parsed with CLI tools. By default infos are NOT
	 quoted.

     -o
	 Displays "True" if packets  exist  in	strict	chronological  order  or
	 "False"  if  one  or  more packets in the capture exists "out-of-order"
	 time-wise.

     -p
	 Display individual packet comments. It is recommended to print raw val-
	 ues (-M) when using this option as packet comments may include newlines
	 and other special characters.

     -P
	 Disable displaying individual packet comments.

     -q
	 Quote infos with single quotes ('). This option  is  only  useful  when
	 generating a table style report (-T). When this option is enabled, each
	 value	will  be  encapsulated within a pair of single quote (') charac-
	 ters. This option (when used  with the -m option) is useful for  gener-
	 ating one type of CSV style file report.

     -Q
	 Quote	infos  with  double  quotes ("). This option is only useful when
	 generating a table style report (-T). When this option is enabled, each
	 value will be encapsulated within a pair of double  quote  (")  charac-
	 ters. This option (when used with the -m option) is useful for generat-
	 ing the most common type of CSV style file report.

     -r
	 Do not generate header record. This option is only useful when generat-
	 ing  a  table	style  report  (-T). If this option is specified then no
	 header record will be generated within the table report.

     -R
	 Generate header record. This option is only useful  when  generating  a
	 table	style  report  (-T).  A header is generated by default. A header
	 record (if generated) is the first line of data reported  and	includes
	 labels for all the columns included within the table report.

     -s
	 Displays  the	size of the file, in bytes. This reports the size of the
	 capture file itself.

     -S
	 Display the earliest and latest packet timestamps as seconds since Jan-
	 uary 1, 1970. Handy for synchronizing dumps using editcap -t.

     -t
	 Displays the capture type of the capture file.

     -T
	 Generate a table report. A table report is a text file that is suitable
	 for importing into a spreadsheet or database. Capinfos can build a  tab
	 delimited  text file (the default) or several variations on Comma-sepa-
	 rated values (CSV) files.

     -u
	 Displays the capture duration, in seconds. This is  the  difference  in
	 time between the earliest packet seen and latest packet seen.

     -v|--version
	 Print the full version information and exit.

     -x
	 Displays the average packet rate, in packets/sec

     -y
	 Displays the average data rate, in bytes/sec

     -z
	 Displays the average packet size, in bytes

DIAGNOSTIC OPTIONS
     --log-level <level>
	 Set  the  active log level. Supported levels in lowest to highest order
	 are "noisy", "debug", "info",	"message",  "warning",	"critical",  and
	 "error". Messages at each level and higher will be printed, for example
	 "warning"  prints  "warning",	"critical",  and  "error"  messages  and
	 "noisy" prints all messages. Levels are case insensitive.

     --log-fatal <level>
	 Abort the program if any messages are logged at the specified level  or
	 higher.  For example, "warning" aborts on any "warning", "critical", or
	 "error" messages.

     --log-domains <list>
	 Only print messages for the specified log domains, e.g.  "GUI,Epan,ssh-
	 dump". List of domains must be comma-separated. Can be negated with "!"
	 as the first character (inverts the match).

     --log-debug <list>
	 Force	the  specified	domains to log at the "debug" level. List of do-
	 mains must be comma-separated. Can be negated with  "!"  as  the  first
	 character (inverts the match).

     --log-noisy <list>
	 Force	the  specified	domains to log at the "noisy" level. List of do-
	 mains must be comma-separated. Can be negated with  "!"  as  the  first
	 character (inverts the match).

     --log-fatal-domains <list>
	 Abort	the program if any messages are logged for the specified log do-
	 mains. List of domains must be comma-separated.

     --log-file <path>
	 Write log messages and stderr output to the specified file.

EXAMPLES
     To see a description of the options use:

	 capinfos -h

     To generate a long form report for the capture file mycapture.pcap use:

	 capinfos mycapture.pcap

     To generate a TAB delimited table form report for the capture  file  mycap-
     ture.pcap use:

	 capinfos -T mycapture.pcap

     To  generate  a  CSV  style  table  form report for the capture file mycap-
     ture.pcap use:

	 capinfos -T -m -Q mycapture.pcap

     or

	 capinfos -TmQ mycapture.pcap

     To generate a TAB delimited table style report  with  just  the  filenames,
     capture  type, capture encapsulation type and packet count for all the pcap
     files in the current directory use:

	 capinfos -T -t -E -c *.pcap

     or

	 capinfos -TtEc *.pcap

     Note: The ability to use of filename globbing characters are a  feature  of
     *nix style command shells.

     To  generate  a  CSV delimited table style report of all infos for all pcap
     files in the current directory and write it to a text  file  called  mycap-
     tures.csv use:

	 capinfos -TmQ *.pcap >mycaptures.csv

     The  resulting  mycaptures.csv file can be easily imported into spreadsheet
     applications.

SEE ALSO
     pcap(3), wireshark(1), mergecap(1), editcap(1), tshark(1), dumpcap(1), cap-
     type(1), pcap-filter(7) or tcpdump(8)

NOTES
     This is the manual page for Capinfos 4.6.6. Capinfos is part of  the  Wire-
     shark  distribution.  The	latest	version  of  Wireshark	can  be found at
     https://www.wireshark.org.

     HTML versions of the Wireshark project man pages are available at
     https://www.wireshark.org/docs/man-pages.

AUTHORS
     Original Author
     Ian Schorr <ian[AT]ianschorr.com>

     Contributors
     Gerald Combs <gerald[AT]wireshark.org>
     Jim Young <jyoung[AT]gsu.edu>

				   2026-05-19			     CAPINFOS(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=capinfos&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>

home | help