This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Dissecting ASCII-encoded hex

0

Hello,

I am trying to dissect a data format that consists of an ASCII-encoded hexadecimal sting. As an example, some data I might receive is 30 30 31 32, which corresponds to the ASCII string 0012. Does Wireshark have any way for me to perform dissection operations on the ASCII data (0012)?

Thanks!

asked 02 Jun '14, 07:47

burwell's gravatar image

burwell
26346
accept rate: 100%


2 Answers:

0

Figured it out. I wrote a function that converts the ASCII characters to hex and used this array to create a new tvbuff_t. Added the new tvbuff_t as a data source and used it for dissection.

answered 04 Jun '14, 06:55

burwell's gravatar image

burwell
26346
accept rate: 100%

0

Not sure what you mean by "perform dissection operations", but in the "Packet Bytes" pane, the ASCII characters are shown in the column to the right of the HEX data.

If you are looking for a display filter to only show packets with 0012, then you can do the "contains" display filter.

For example: frame contains "0012"

or, if it is specifically in TCP data: tcp contains "0012"

Hope this helps.

Travis

answered 02 Jun '14, 12:11

Rooster_50's gravatar image

Rooster_50
23891218
accept rate: 15%