CLI tool to run SQL queries directly on PCAP files
https://www.dns-oarc.net/tools/packetq

A command line tool to run SQL queries directly on PCAP files, the results
can be outputted as JSON (default), formatted/compact CSV and XML.#
It also contain a very simplistic web-server in order to inspect PCAP files
remotely.
PacketQ was previously known as DNS2db but was renamed in 2011 when it was
rebuilt and could handle protocols other than DNS among other things.