This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Text to PCAP, no option to save native trace in PCAP format!

0

Hello,

Does anyone know how to convert a text file to a PCAP? This is not a hex dump, it is a raw text file of what would be in a typical PCAP. The device im capturing from (ASR5000) displays the trace output in window with no ability to write it to a file so I have no ability to specify like i would in a normal tcpdump. I need to be able to get this file into a PCAP or other format that is usable in Wireshark. The customer is having a really hard time with the text file since they are not used to traces looking like this.

A small example excerpt is below, any help is greatly appreciated.

Friday July 01 2016 INBOUND>>>>> 22:10:04:544 Eventid:87730(18)

===> Radio Access Network Application Part (RANAP) (54 bytes) RANAP PDU | 0... .... | Ext bit : 0 | .00. .... | Choice index : Initiating Message (0) Procedure Code : id-Direct Transfer (20)

asked 01 Jul '16, 16:24

Dave16's gravatar image

Dave16
6113
accept rate: 0%


One Answer:

1

Unfortunately, I know of no tools that "undo" the formatting and attempt to figure out what the raw binary data is; that's what would be needed here. Unless there's some command that I missed in a quick search of the command line reference, you may be completely out of luck here.

answered 01 Jul '16, 17:51

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Thanks for the reply, I went through the CLI reference also. This is the only NE I have ever worked with that behaves like this when tracing.

found this also which i found pretty funny https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuq69977

(01 Jul '16, 21:51) Dave16