This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to export or display capture traffic in this format? - Ethernet II excluded

0

4500 0028 596c 4000 8006 d127 0a3b 00a3 36ef 8e6f c12f 0050 1817 84d1 7a9b 5b14 5011 0fc69 bb90 000

asked 19 May '13, 11:25

OMara's gravatar image

OMara
1111
accept rate: 0%


2 Answers:

1

Well, wireshark (with >2million lines of code) is a bit overkill for that, why not use a simple perl script:

#!/opt/local/bin/perl -w

use strict; use Net::PcapUtils; use NetPacket::Ethernet;

Net::PcapUtils::loop(&process_pkt, FILTER => 'ip proto 1');

sub process_pkt { my ($user_data,$hdr,$pkt)=@_; my $eth=NetPacket::Ethernet->decode($pkt); if($eth->{type} == 2048){ printf "%s\n", unpack("H*", $eth->{data}); } }

which gives the following output (for a ping to 8.8.8.8):

450000544f3d00004001599fc0a801150808080808006e73b68e00005199293100006d3008090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637
45280054000000003201b6b408080808c0a8011500007673b68e00005199293100006d3008090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637
45000054e97400004001bf67c0a801150808080808006e28b68e00015199293200006d7908090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637
45280054000000003201b6b408080808c0a8011500007628b68e00015199293200006d7908090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637

I’ll leave the proper filtering and layout enhancements as an exercise for the reader :-)

answered 19 May ‘13, 12:36

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

0

I guess by going to File -> Export Packet Dissections -> as Plain Text File. Then on the "Packet Format" pane uncheck everything except "Packet Bytes".

answered 19 May '13, 11:42

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

But that doesn't exclude Ethernet II. Thanks.

(19 May '13, 11:45) OMara

Sorry, I thought "Ethernet excluded" meant that you removed it from your quote due to sanitization purposes. I guess if you want to export packets without the Ethernet header Wireshark will not help you unless you find a way to edit each frame by script after exporting it.

May I ask why you need to remove the ethernet header? Maybe there's another solution I can think of.

(19 May '13, 11:48) Jasper ♦♦

For testing purposes. I can copy each frame and edit it but it is tedious. I appreciate your help.

(19 May '13, 12:37) OMara

The new export PDU functionality could be made to do that.

(19 May '13, 15:20) Anders ♦