Pcap to arff conversion?

Question

I wanted to know if there's a way to convert pcap files into arff files so that they can be inputted and used by weka? I am currently working on internet traffic analysis and the only way i can collect data is through coralreef and wireshark. Though helpful they do not have a feature that helps me with this conversion. So is it possible?

Answer 1

Its easy to convert pcap to csv file format using wireshark. you can go to option and then export packet dissection in csv. It is readable in weka with features. secondly you can use netmate a linux plateform based softare to convert pcap in arff file.

Answer 2

The ARFF format is used to describe features, while pcap is used to describe packets. There is no magic way to turn packets into features, you have to know what features you want and extract them.