This is our old Q&A Site. Please post any new questions and answers at

Pardon the (probably) stupid question, but I'm completely new to Wireshark. I've just captured some packets and am trying to read them. One of the lines from the capture looks like this:

0030  32 30 2d 32 32 30 32 53  05 f1 32 7d 05 f1 32 0b   2.-22.2. .12'.12.

I thought that the right side was supposed to be the ASCII translation of the raw hex dump on the left. The first byte 32 is indeed the number "2" as shown on the right. However, the second byte, 30 is the digit "0". This is translated to "." on the ASCII side, which is wrong. The next 3 digits are right, but the forth one is wrong again. Is something configured incorrectly?

asked 15 Nov '11, 19:22

prezt's gravatar image

accept rate: 0%

edited 15 Nov '11, 19:26

helloworld's gravatar image


That's strange. Can you upload this packet capture (sanitized as necessary) to cloudshark and post a link here?

(15 Nov '11, 19:31) helloworld

I just validated tshark and Wireshark using a recent SVN build on OSX 10.7.2:

0030  32 30 2d 32 32 30 32 0a                           20-2202.

What version is your Wireshark and OS?

(15 Nov '11, 19:52) helloworld

Could this be a font related problem? What font are you using (Edit -> Preferences -> Font)

permanent link

answered 16 Nov '11, 03:06

packethunter's gravatar image

accept rate: 8%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 Nov '11, 19:22

question was seen: 2,453 times

last updated: 16 Nov '11, 03:06

p​o​w​e​r​e​d by O​S​Q​A