Hi,not able to convert hex offset to pcap through text2pcap when there is pattern like 0000 0002 4500 0148 6833 0000 8011 bab6,actually i am taking output from juniper monitor traffic output command and it provides output in above ascii format.Please refere link http://kb.juniper.net/InfoCenter/index?page=content&id=KB23952, in link it says put a space after each of 2 hex character.Is it possible through text2pcap. asked 21 May '14, 04:19 kishan pandey |
One Answer:
I can't access your link as it requires registration. The format of text2pcap is clearly specified in the man page for the program, an offset of more than 2 digits, a space, then byte values as 2 hex digits separated by a space. You'll have to arrange your input text into the required format. There is more info in text2pcap in the Wireshark docs. answered 21 May '14, 04:48 grahamb ♦ |
Thanks graham,i thihnk via xxd tool we can do this