Is it possible to capture TCPDUMP logging and import into Wireshark?

OK, I did some testing, you can use the following also. Dump the packet data with '-xx' (double x to get the link layer data too) like this:

$ tcpdump -nli en1 -xx -s0 -c 3 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on en1, link-type EN10MB (Ethernet), capture size 65535 bytes
23:06:22.515580 IP 192.168.1.22 > 8.8.8.8: ICMP echo request, id 44623, seq 0, length 64
    0x0000:  0012 1ebb d132 f81e dfd8 8748 0800 4500
    0x0010:  0054 153e 0000 4001 939d c0a8 0116 0808
    0x0020:  0808 0800 72d6 ae4f 0000 502a bdce 0007
    0x0030:  ddd6 0809 0a0b 0c0d 0e0f 1011 1213 1415
    0x0040:  1617 1819 1a1b 1c1d 1e1f 2021 2223 2425
    0x0050:  2627 2829 2a2b 2c2d 2e2f 3031 3233 3435
    0x0060:  3637
23:06:22.538398 IP 8.8.8.8 > 192.168.1.22: ICMP echo reply, id 44623, seq 0, length 64
    0x0000:  f81e dfd8 8748 0012 1ebb d132 0800 4500
    0x0010:  0054 5a72 0000 3701 5769 0808 0808 c0a8
    0x0020:  0116 0000 7ad6 ae4f 0000 502a bdce 0007
    0x0030:  ddd6 0809 0a0b 0c0d 0e0f 1011 1213 1415
    0x0040:  1617 1819 1a1b 1c1d 1e1f 2021 2223 2425
    0x0050:  2627 2829 2a2b 2c2d 2e2f 3031 3233 3435
    0x0060:  3637
23:06:23.515979 IP 192.168.1.22 > 8.8.8.8: ICMP echo request, id 44623, seq 1, length 64
    0x0000:  0012 1ebb d132 f81e dfd8 8748 0800 4500
    0x0010:  0054 4543 0000 4001 6398 c0a8 0116 0808
    0x0020:  0808 0800 714b ae4f 0001 502a bdcf 0007
    0x0030:  df5f 0809 0a0b 0c0d 0e0f 1011 1213 1415
    0x0040:  1617 1819 1a1b 1c1d 1e1f 2021 2223 2425
    0x0050:  2627 2829 2a2b 2c2d 2e2f 3031 3233 3435
    0x0060:  3637
3 packets captured
62 packets received by filter
0 packets dropped by kernel
$

Then copy the output and process it with sed like this:

$ cat screendump.txt | sed -e 's/ \([^ ][^ ]\)\([^ ][^ ]\)/ \1 \2/g' -e 's/^\(..:..:..\).*$/\1/' -e 's/^.*0x\(....\): /\1/' 
23:06:22
0000 00 12 1e bb d1 32 f8 1e df d8 87 48 08 00 45 00
0010 00 54 15 3e 00 00 40 01 93 9d c0 a8 01 16 08 08
0020 08 08 08 00 72 d6 ae 4f 00 00 50 2a bd ce 00 07
0030 dd d6 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15
0040 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25
0050 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35
0060 36 37
23:06:22
0000 f8 1e df d8 87 48 00 12 1e bb d1 32 08 00 45 00
0010 00 54 5a 72 00 00 37 01 57 69 08 08 08 08 c0 a8
0020 01 16 00 00 7a d6 ae 4f 00 00 50 2a bd ce 00 07
0030 dd d6 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15
0040 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25
0050 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35
0060 36 37
23:06:23
0000 00 12 1e bb d1 32 f8 1e df d8 87 48 08 00 45 00
0010 00 54 45 43 00 00 40 01 63 98 c0 a8 01 16 08 08
0020 08 08 08 00 71 4b ae 4f 00 01 50 2a bd cf 00 07
0030 df 5f 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15
0040 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25
0050 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35
0060 36 37
$

If you redirect that output to a file, it can be imported in Wireshark with "File -> Import...", just make sure you enable timestamps and give "%T" as time format.

(if you're on Windows, you might want to consider installing a sed program or cygwin)

Unfortunately that is not possible, as the packet bytes get lost. You might be able to use some scripting to be able to import "tcpdump -s0 -x -i eth0" output.

If the problem is that you can only copy screen output, you might want to save the trace locally with "tcpdump -s0 -w tmp.cap" and then use uuencode to create ascii text on the screen which you can copy & paste and uudecode.

Or do it in one go: "tcpdump -s0 -i en1 -w - -c 10 2>/dev/null | uuencode tmp.cap"

There are some other options as well.

xxd
xxd is available (per default) on many Linux distributions and there is also a windows version (e.g. as part of vim - http://www.vim.org)

tcpdump -ni eth0 -s0 -w /var/tmp/dump.pcap
xxd /var/tmp/dump.pcap /var/tmp/dump.hex
cat /var/tmp/dump.hex

Copy the output and save it as dump.hex on another system. Then use xxd on that system to revert the hex dump back to a binary.

xxd -r dump.hex dump.pcap

You can now open dump.pcap in Wireshark.

remote capture with ssh
I assume, you are able to connect to the system with ssh to run the tcpdump command. However, if that is possible, you could also just copy the binary data with scp through that channel, and the whole HEX -> binary conversion would not be necessary !??!

ssh -l root 192.168.0.1 "tcpdump -ni eth0 -s0 -w -" > dump.pcap

Then open dump.pcap in Wireshark.

UPDATE:
If you don't have xxd on your system, you can also use hexdump and then convert the output to something xxd understands.

HOWTO:

• run this command

  hexdump -C input.cap | awk '{$1 = substr($1,2) ":"; gsub(/\|/," "); gsub(/[0-9a-f]+:$/,""); print}' > capture.hex
  

• copy/paste the output of capture.hex to your windows system
• install vim from http://www.vim.org

• run the following commands
  

  cd %PROGRAMFILES%\vim\vim73
xxd -r c:\temp\capture.hex c:\temp\capture.pcap
  

• open c:\temp\capture.pcap in Wireshark

Regards
Kurt

I recently used a remote command over ssh to pipe back into a local copy of tshark which then wrote into local files.

ssh [email protected] "tcpdump -i eth0 -w -" | tshark -i - -b filesize:50000 -w dump.pcap

Note that I had installed a public key for the user on the remote system so no user input was required on the ssh connection.