This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Create a custom text file from wireshark

0

Hi,

I have a pcap USB file which I am using to decode a custom protocol. My protocol analyzer expect a stream of hex bytes which I need to export from wireshark. Is there anyway to do this? I need to export only bulk out packets which are issues from the host to the device. Right now I select each packet and copy this field. alt text

I then open a text file and paste the data. The data format looks like this "byte1:byte2:byte3:byte4:....." I need a continous stream of all the bytes, in the capture data section. Does anyone know how to do this?

asked 15 Jul '16, 03:15

losang's gravatar image

losang
6●1●1●3
accept rate: 0%

edited 15 Jul '16, 03:16

One Answer:

0

Maybe you can use tshark and sed?

For example:

tshark -r usbfile.pcapng -Y usb.capdata -T fields -e usb.capdata | sed s/://g

answered 15 Jul '16, 10:21

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Let me try that out.

(15 Jul '16, 19:15) losang

I have no idea how complex your protocol is and using which language you have written your analyzer, but have you checked the possibility to write a dissector in Lua, allowing you to code only the dissection logic and get the access to the whole power of Wireshark, such as display filters, export possibilities etc.? Doing the same in C is of course even better but the advantage of Lua is that you do not need to compile Wireshark.

(16 Jul '16, 05:41) sindy