This is a static archive of our old Q&A Site. Please post any new questions and answers at

Text to PCAP, no option to save native trace in PCAP format!



Does anyone know how to convert a text file to a PCAP? This is not a hex dump, it is a raw text file of what would be in a typical PCAP. The device im capturing from (ASR5000) displays the trace output in window with no ability to write it to a file so I have no ability to specify like i would in a normal tcpdump. I need to be able to get this file into a PCAP or other format that is usable in Wireshark. The customer is having a really hard time with the text file since they are not used to traces looking like this.

A small example excerpt is below, any help is greatly appreciated.

Friday July 01 2016 INBOUND>>>>> 22:10:04:544 Eventid:87730(18)

===> Radio Access Network Application Part (RANAP) (54 bytes) RANAP PDU | 0... .... | Ext bit : 0 | .00. .... | Choice index : Initiating Message (0) Procedure Code : id-Direct Transfer (20)

asked 01 Jul '16, 16:24

Dave16's gravatar image

accept rate: 0%

One Answer:


Unfortunately, I know of no tools that "undo" the formatting and attempt to figure out what the raw binary data is; that's what would be needed here. Unless there's some command that I missed in a quick search of the command line reference, you may be completely out of luck here.

answered 01 Jul '16, 17:51

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Thanks for the reply, I went through the CLI reference also. This is the only NE I have ever worked with that behaves like this when tracing.

found this also which i found pretty funny

(01 Jul '16, 21:51) Dave16