This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I am currently trying to write a program which parses a PDML file and extracts the TCP payload for packets sent from a particular IP, I need this in the form of a Hex dump.

The problem I have, is not all packets have a simple "fake-field-wrapper". And some contain application layer data such as SMB.

What would be the best way of dumping the hex for these packets?

Also, I would only like to output all of the TCP payload from a single TCP stream. How do you know what is a 'single' TCP stream, any type of identifier? Or would I just have to do a for loop and fetch every packet until an ACK/SYN packet?

asked 25 Aug '14, 03:55

WireTshark's gravatar image

WireTshark
5225
accept rate: 0%

edited 25 Aug '14, 04:45

Jasper's gravatar image

Jasper ♦♦
23.8k551284

Is it a requirement that this be done through PDML, or is working with the raw .pcap file a possibility?

(25 Aug '14, 06:58) Quadratic

I would like to see if it could be done with PDML output. If the possibility of this is limited, I could consider looking at raw.pcap files

(25 Aug '14, 07:14) WireTshark

So I assume my answer to this question helps you with most of what you're asking for here, leaving only the last part of your question regarding how to output all of the TCP payload from a single TCP stream.

I would say that probably the easiest ways to achieve this are to use one of the following methods:

  • Apply a display filter for the tcp stream number you're interested in, e.g., tcp.stream == 1, and then only export those displayed packets. The tcp.stream field is a Wireshark-generated field, which you can find by expanding the TCP protocol in the packet details pane.
  • In the packet details pane, right-click on a packet of interest and choose, "Conversation Filter -> TCP". This effectively accomplishes the same thing as the first method.
permanent link

answered 26 Aug '14, 08:51

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×52
×19
×13
×12

question asked: 25 Aug '14, 03:55

question was seen: 2,324 times

last updated: 26 Aug '14, 08:51

p​o​w​e​r​e​d by O​S​Q​A