up vote 0 down vote favorite
1
share [g+] share [fb]

I have packet in a text file how I can convert it to .cap file? I need to analyze this packet by Wireshark.

Thanks

link|improve this question
feedback

1 Answer

up vote 2 down vote

How is the text file formatted? What kind of data does it contain? If it's some sort of hex dump, e.g.

9   0.167204 64.28.67.150 -> 192.168.0.2  TCP 80 > 2741 [ACK] Seq=1 Ack=641 Win=7040 Len=0 TSV=282917349 TSER=38398814

0000  00 20 af 1b 07 fa 00 e0 29 68 8b fb 08 00 45 00   . ......)h....E.
0010  00 34 9e 12 40 00 26 06 72 55 40 1c 43 96 c0 a8   .4..@.&.rU@.C...
0020  00 02 00 50 0a b5 75 c8 67 f6 74 49 46 3d 80 10   ...P..u.g.tIF=..
0030  1b 80 7b 2c 00 00 01 01 08 0a 10 dc f9 e5 02 49   ..{,...........I
0040  eb 5e                                             .^

you should be able to use text2pcap to convert it.

link|improve this answer
yes its same your example, Thank you very much – user56693 Oct 10 '10 at 18:52
I am trying now to find the text2pcap app and download it – user56693 Oct 10 '10 at 18:57
Sorry mate, where I can find the text2pcap app? and how I can use it. – user56693 Oct 10 '10 at 19:00
@freehonest, I believe it's part of the wireshark install. On my windows machine, it's located at C:\Program Files\Wireshark\text2pcap.exe. – dsolimano Oct 10 '10 at 19:05
@dsolimano is correct. It and a bunch of other command line utilities are part of the default Windows and OS X installs. On Linux you have to install the "bunch of CLI utilities that ship with Wireshark package" which is often named "wireshark-common" or something similar. – Gerald Combs Oct 10 '10 at 23:56
feedback

Your Answer

 
or
required, but never shown
discard