# Convert .txt file to .cap to open it by Wireshark

I have packet in a text file how I can convert it to .cap file? I need to analyze this packet by Wireshark.

Thanks

-

I have the following from a cisco packet capture as a large text file.

00000000:  A1B2C3D4 00020004 00000000 00000000    !2CT .... .... ....
00000010:  000005EE 0000000C 53F608E8 00074B1B    ...n .... Sv.h ..K.
00000020:  000000C4 000000C4 450000C4 10160000    ...D ...D E..D ....


I see that there needs to be spaces between every hex set of characters like this for it to be recognized by wireshark.

00000000:  A1 B2 C3 D4 00 02 00 04 00 00 00 00 00 00 00 00    !2CT .... .... ....
00000010:  00 00 05 EE 00 00 00 0C 53 F6 08 E8 00 07 4B 1B    ...n .... Sv.h ..K.
00000020:  00 00 00 C4 00 00 00 C4 45 00 00 C4 10 16 00 00    ...D ...D E..D ....


I tested using text2pcap but it wont convert it correctly. The file is huge. Anyone know how to get text2pcap to do this?

-

How is the text file formatted? What kind of data does it contain? If it's some sort of hex dump, e.g.

9   0.167204 64.28.67.150 -> 192.168.0.2  TCP 80 > 2741 [ACK] Seq=1 Ack=641 Win=7040 Len=0 TSV=282917349 TSER=38398814

0000  00 20 af 1b 07 fa 00 e0 29 68 8b fb 08 00 45 00   . ......)h....E.
0010  00 34 9e 12 40 00 26 06 72 55 40 1c 43 96 c0 a8   .4..@.&.rU@.C...
0020  00 02 00 50 0a b5 75 c8 67 f6 74 49 46 3d 80 10   ...P..u.g.tIF=..
0030  1b 80 7b 2c 00 00 01 01 08 0a 10 dc f9 e5 02 49   ..{,...........I
0040  eb 5e                                             .^


you should be able to use text2pcap to convert it.

-
yes its same your example, Thank you very much –  user56693 Oct 10 '10 at 18:52
I am trying now to find the text2pcap app and download it –  user56693 Oct 10 '10 at 18:57
Sorry mate, where I can find the text2pcap app? and how I can use it. –  user56693 Oct 10 '10 at 19:00
@freehonest, I believe it's part of the wireshark install. On my windows machine, it's located at C:\Program Files\Wireshark\text2pcap.exe. –  dsolimano Oct 10 '10 at 19:05
@dsolimano is correct. It and a bunch of other command line utilities are part of the default Windows and OS X installs. On Linux you have to install the "bunch of CLI utilities that ship with Wireshark package" which is often named "wireshark-common" or something similar. –  Gerald Combs Oct 10 '10 at 23:56