PCAP → Flows CSV
Upload a PCAP/PCAPNG, optionally add a Wireshark display filter, and export flows as CSV.
Preview
CSV preview will appear here after export.
About
This tool summarizes packet captures into “flows” and exports them as a simple CSV, so you can quickly see which conversations dominate by volume. Upload a PCAP/PCAPNG and optionally add a Wireshark display filter to focus on the traffic you care about.
Use Top N and sorting (bytes/packets) to get a concise list you can paste into spreadsheets, tickets, or reports. DNS name enrichment can make endpoints easier to recognize when you’re triaging a capture.
Flows are ideal for quick investigation: identify top talkers, heavy ports, unexpected protocols, or a suspicious pair that deserves deeper packet-level inspection.
Search activity
pcap to flows csvpcapng to flows csvexport flows from pcappcap 5-tuple flow csvpcap top flows by bytespcap top flows by packetspcap flows with dns nameswireshark flow csv exporttshark flows csvpcap flows display filterpcap conversations csvpcap flows wireshark display filter
FAQ
›What does “flow” mean here?
A flow is a summarized conversation (typically 5-tuple: src/dst IP, ports, protocol) with totals like bytes and packets.
›Can I filter before exporting?
Yes. Use a Wireshark display filter to export only matching traffic.
›What is included in the CSV?
Flow identifiers plus counters (bytes/packets) and optional DNS names if enabled.
›Why do I see fewer rows than packets?
Many packets belong to the same flow; flows aggregate multiple packets into one row.
›Is the capture stored?
The file is processed to produce the CSV and is not intended to be retained.
Related Tools
- PCAP Conversations/tools/pcap-to-endpoints
- PCAP → JSON/tools/pcap-to-json
- HTTP Headers & Redirects/tools/network/headers
- DNS Propagation Checker/tools/network/dns-check
- Subnet Calculator/tools/network/subnet