1

Does anyone know of a tool to open a packet capture saved as a .bin file? That or how to convert it to pcap or something wireshark can open.

I took a packet capture from a thin client and when I download it its a .bin file type. I have not been able to find out who to open it to view it.

  • The problem is that .bin is a generic file type - it could be any format. Can you post some more details? – Dan Mar 28 '17 at 15:59
  • @Dan the packet capture is from a wyse 5030 thin client – veel84 Mar 28 '17 at 16:00
  • And what option did you use to acquire it? "Network capture to USB" should give you a pcap file according to this: manualslib.com/manual/854562/… Though I confess to never having actually tried it myself. Your firmware OS may be different though - I'm not sure what exactly those run – Dan Mar 28 '17 at 16:04
  • @Dan yea this model does not have that option, it's just a web admin page with an option to start the capture then download it. – veel84 Mar 28 '17 at 16:05
  • Is this definitely a network capture - some of them have a feature where you're capturing a video of the screen. Try opening your bin file in VLC... – Dan Mar 28 '17 at 16:06
1

I had to create an account at the teradici website, their website just says its in binary format, but they do provide a script in python to convert it to a pcap. KB2484.

The script says i'm not allowed to post publicly so I wont do that. Link

  • It's too bad that the conversion process involves running the convert_to_pcap.py script, which utilizes an intermediate text file that is then run through text2pcap in order to save the data into a pcap file. This isn't particularly efficient. Ideally, Wireshark could be modified to be able to directly read the file without requiring any conversion at all, and you might consider opening a Wireshark bug report for this, but barring that, it would be much better if the conversion tool was able to directly generate a pcap file instead of using an intermediate step. Can you post a capture file? – Christopher Maynard Apr 7 '17 at 16:45
  • here it is Example bin pcap – veel84 Apr 26 '17 at 13:05
  • I think it should be possible to modify the script to write pcap files directly. The bin file format contains no global header, only a packet header of the following format (all multi-byte fields are little-endian): - Hour: 1 byte - Day: 1 byte - Month: 1 byte - Unused: 1 byte - Milliseconds: 2 bytes - Seconds: 1 byte - Minutes: 1 byte - Length: 4 bytes - "Length" bytes of packet data follows If month is 0, assume June 1, 1999. To convert, use the libpcap format, documented here: wiki.wireshark.org/Development/LibpcapFileFormat – Christopher Maynard Apr 27 '17 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.