This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I have a pcap USB file which I am using to decode a custom protocol. My protocol analyzer expect a stream of hex bytes which I need to export from wireshark. Is there anyway to do this? I need to export only bulk out packets which are issues from the host to the device. Right now I select each packet and copy this field. alt text

I then open a text file and paste the data. The data format looks like this "byte1:byte2:byte3:byte4:....." I need a continous stream of all the bytes, in the capture data section. Does anyone know how to do this?

asked 15 Jul '16, 03:15

losang's gravatar image

losang
6113
accept rate: 0%

edited 15 Jul '16, 03:16


Maybe you can use tshark and sed?

For example:

tshark -r usbfile.pcapng -Y usb.capdata -T fields -e usb.capdata | sed s/://g
permanent link

answered 15 Jul '16, 10:21

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142
accept rate: 20%

Let me try that out.

(15 Jul '16, 19:15) losang

I have no idea how complex your protocol is and using which language you have written your analyzer, but have you checked the possibility to write a dissector in Lua, allowing you to code only the dissection logic and get the access to the whole power of Wireshark, such as display filters, export possibilities etc.? Doing the same in C is of course even better but the advantage of Lua is that you do not need to compile Wireshark.

(16 Jul '16, 05:41) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×69
×12

question asked: 15 Jul '16, 03:15

question was seen: 583 times

last updated: 16 Jul '16, 05:41

p​o​w​e​r​e​d by O​S​Q​A