0

I have packet in a text file how I can convert it to .cap file? I need to analyze this packet by Wireshark.

Thanks

1 Answer 1

2

How is the text file formatted? What kind of data does it contain? If it's some sort of hex dump, e.g.

9   0.167204 64.28.67.150 -> 192.168.0.2  TCP 80 > 2741 [ACK] Seq=1 Ack=641 Win=7040 Len=0 TSV=282917349 TSER=38398814

0000  00 20 af 1b 07 fa 00 e0 29 68 8b fb 08 00 45 00   . ......)h....E.
0010  00 34 9e 12 40 00 26 06 72 55 40 1c 43 96 c0 a8   .4..@.&[email protected]...
0020  00 02 00 50 0a b5 75 c8 67 f6 74 49 46 3d 80 10   ...P..u.g.tIF=..
0030  1b 80 7b 2c 00 00 01 01 08 0a 10 dc f9 e5 02 49   ..{,...........I
0040  eb 5e                                             .^

you should be able to use text2pcap to convert it.

4
  • I am trying now to find the text2pcap app and download it
    – user56693
    Oct 10, 2010 at 18:57
  • Sorry mate, where I can find the text2pcap app? and how I can use it.
    – user56693
    Oct 10, 2010 at 19:00
  • @freehonest, I believe it's part of the wireshark install. On my windows machine, it's located at C:\Program Files\Wireshark\text2pcap.exe.
    – dsolimano
    Oct 10, 2010 at 19:05
  • @dsolimano is correct. It and a bunch of other command line utilities are part of the default Windows and OS X installs. On Linux you have to install the "bunch of CLI utilities that ship with Wireshark package" which is often named "wireshark-common" or something similar. Oct 10, 2010 at 23:56

You must log in to answer this question.