How to Convert a Wireshark Trace to an Open Office Graph

The hardest technique to master with protocol analysis is spotting a pattern, or to be more precise a change in pattern. A break in pattern may explain a performance issue, disconnection, or application anomaly.

For example, it can be extremely difficult to look at a trace file and determine when throughput dropped or latency jumped up. Wireshark has a graphing facility but many times I want to do something specific or change the chart format.

I have shown analysts how to import a Wireshark trace file to Excel, but I get many requests asking how to do this with an open source spreadsheet. In this article I use Open Office’s Calc and walk you through how to import a trace file and create a simple Bytes/sec graph.

For those of you familiar with CSV files, that is the heart of this exercise.Once you convert a trace file into a CSV file, you can import it into a spread sheet, database or even write your own script to handle the data.

When using a graph, you can easily see the peaks and valleys of the trace rather than staring at a couple hundred packets per second. Give it a try and I’m sure you will be looking at packets graphically instead of the traditional text-based view.