This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Raw Hex format of an http packet.

0

Can someone tell me how to look at a packet in raw form. I want to see the preamble and every octet after in binary or hex form. I want to look at the packet and find the destination ip adress,the payload length, the payload, etc.

For example I will go to google.com in my browser and then look at the raw response.

asked 14 Aug '12, 13:41

guitardenver's gravatar image

guitardenver
1111
accept rate: 0%


One Answer:

0

Wireshark will not show you the Ethernet preamble or the start-of-frame delimiter; they are not present in the frame when Wireshark sees it. Ethernet frames will start with the destination MAC address.

To see everything in hex, simply make sure the Packet Bytes pane is visible (View > Packet Bytes). The packet contents will be shown on the left in hex, and on the right in ASCII.

answered 14 Aug '12, 14:53

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%