When I export the packet out to a text file,there are hexadecimal data in the file If there is a data field in the packet detail pane.But if there is not this field,I can not get the data when export the packet out to the text file in spite of it contains many bytes data. The data field Such as the following:
asked 07 May '12, 19:10
When you select Export->File from the File menu, take a look at the "Export File" dialog box. On the bottom right of the dialog box, you'll see "Packet Format" options. Here's where you can change the format of the exported data.
If "Packet details" is set to "As displayed", your text file will look like the Packet Details window; whatever is expanded in that window will be expanded in the text file.
You can set "Packet details" to "All expanded" to automatically expand every field.
You can also enable "Packet bytes" to show the full dump of each packet.
answered 08 May '12, 07:24
In the 2nd pcap you've uploaded ("no data field.pcap"), the UDP data is being parsed by the Packet Cable dissector, which parses 3 bytes and consumes the rest of the data (thus hiding the Data field you seek). You can prevent the Packet Cable dissector from eating up your data by disabling the dissector in one of the following ways:
answered 09 May '12, 23:45