This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I am trying to dissect a data format that consists of an ASCII-encoded hexadecimal sting. As an example, some data I might receive is 30 30 31 32, which corresponds to the ASCII string 0012. Does Wireshark have any way for me to perform dissection operations on the ASCII data (0012)?

Thanks!

asked 02 Jun '14, 07:47

burwell's gravatar image

burwell
26346
accept rate: 100%


Figured it out. I wrote a function that converts the ASCII characters to hex and used this array to create a new tvbuff_t. Added the new tvbuff_t as a data source and used it for dissection.

permanent link

answered 04 Jun '14, 06:55

burwell's gravatar image

burwell
26346
accept rate: 100%

Not sure what you mean by "perform dissection operations", but in the "Packet Bytes" pane, the ASCII characters are shown in the column to the right of the HEX data.

If you are looking for a display filter to only show packets with 0012, then you can do the "contains" display filter.

For example: frame contains "0012"

or, if it is specifically in TCP data: tcp contains "0012"

Hope this helps.

Travis

permanent link

answered 02 Jun '14, 12:11

Rooster_50's gravatar image

Rooster_50
23891218
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×23
×16

question asked: 02 Jun '14, 07:47

question was seen: 2,457 times

last updated: 04 Jun '14, 06:55

p​o​w​e​r​e​d by O​S​Q​A