Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have packet in a text file how I can convert it to .cap file? I need to analyze this packet by Wireshark.

Thanks

share|improve this question

2 Answers 2

I have the following from a cisco packet capture as a large text file.

00000000:  A1B2C3D4 00020004 00000000 00000000    !2CT .... .... .... 
00000010:  000005EE 0000000C 53F608E8 00074B1B    ...n .... Sv.h ..K. 
00000020:  000000C4 000000C4 450000C4 10160000    ...D ...D E..D ....

I see that there needs to be spaces between every hex set of characters like this for it to be recognized by wireshark.

00000000:  A1 B2 C3 D4 00 02 00 04 00 00 00 00 00 00 00 00    !2CT .... .... .... 
00000010:  00 00 05 EE 00 00 00 0C 53 F6 08 E8 00 07 4B 1B    ...n .... Sv.h ..K. 
00000020:  00 00 00 C4 00 00 00 C4 45 00 00 C4 10 16 00 00    ...D ...D E..D ....

I tested using text2pcap but it wont convert it correctly. The file is huge. Anyone know how to get text2pcap to do this?

share

How is the text file formatted? What kind of data does it contain? If it's some sort of hex dump, e.g.

9   0.167204 64.28.67.150 -> 192.168.0.2  TCP 80 > 2741 [ACK] Seq=1 Ack=641 Win=7040 Len=0 TSV=282917349 TSER=38398814

0000  00 20 af 1b 07 fa 00 e0 29 68 8b fb 08 00 45 00   . ......)h....E.
0010  00 34 9e 12 40 00 26 06 72 55 40 1c 43 96 c0 a8   .4..@.&.rU@.C...
0020  00 02 00 50 0a b5 75 c8 67 f6 74 49 46 3d 80 10   ...P..u.g.tIF=..
0030  1b 80 7b 2c 00 00 01 01 08 0a 10 dc f9 e5 02 49   ..{,...........I
0040  eb 5e                                             .^

you should be able to use text2pcap to convert it.

share|improve this answer
    
yes its same your example, Thank you very much –  user56693 Oct 10 '10 at 18:52
    
I am trying now to find the text2pcap app and download it –  user56693 Oct 10 '10 at 18:57
    
Sorry mate, where I can find the text2pcap app? and how I can use it. –  user56693 Oct 10 '10 at 19:00
    
@freehonest, I believe it's part of the wireshark install. On my windows machine, it's located at C:\Program Files\Wireshark\text2pcap.exe. –  dsolimano Oct 10 '10 at 19:05
    
@dsolimano is correct. It and a bunch of other command line utilities are part of the default Windows and OS X installs. On Linux you have to install the "bunch of CLI utilities that ship with Wireshark package" which is often named "wireshark-common" or something similar. –  Gerald Combs Oct 10 '10 at 23:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.