This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm looking to convert pcap file to a raw dump of the bytes of the packets.

This is when export file to txt file using wireshark alt text

then the requirement data is only hex data in red box. Because packet data is too much, so need some script to implement this. alt text

and this the result and create multiple file depend on number of packet dataalt text

asked 26 Jan '11, 13:13

faz's gravatar image

faz
1111
accept rate: 0%


I'm not entirely sure I understand what you're asking. If you want just the ASCII hex dump of all data and nothing else, then you can simply pipe the output of tshark through sed like so:

tshark -x -r mydata.pcap | sed -n 's/^[0-9a-f]*\s\(\(\s[0-9a-f][0-9a-f]\)\{1,16\}\).*$/\1/p'

If that's not what you're asking, perhaps you could clarify. I don't understand "create multiple file depend on number of packet data." Do you mean that you want to create one file per packet? Is the file to be a hex dump (printable form) or is it a pure binary file?

permanent link

answered 26 Jan '11, 14:08

beroset's gravatar image

beroset
2261213
accept rate: 33%

edited 08 Oct '13, 13:21

when i'm try using tshark thought sed..give some error:

'sed' is not recognized as an internal or external command, operable program or batch file.

yes,I just want hex data only and want to create one file per packet. In this picture (printable form) is not same file with above. That's is just some example only. But actually hex data will be same.

(27 Jan '11, 11:32) faz

You're probably running Windows; I'm not sure what commands that come with Windows would help here, but you might look at sed for Windows.

(27 Feb '11, 23:28) Guy Harris ♦♦

The sed command given above didn't work for me. I'm no sed expert so there's probably a better, more robust way to do this, but the following seemed to work for me, for what it's worth:

tshark -x -r mydata.pcap | sed -n 's/^[0-9a-f][0-9a-f]*  \(.*  \) .*/\1/p'

faz, since your system doesn't have sed installed, I can logically conclude that you are most likely working on Windows, so you will probably need to install cygwin in order to have sed at your disposal. There may be some other "sed for Windows" alternatives if you don't want to install cygwin.

You can find more information on sed here or here or at a number of other places.

permanent link

answered 24 Feb '11, 12:47

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×12
×2

question asked: 26 Jan '11, 13:13

question was seen: 17,940 times

last updated: 08 Oct '13, 13:48

p​o​w​e​r​e​d by O​S​Q​A