This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Filtering TShark output to only capture decrypted hexadecimal

0

I'm using tshark to decode WPA packets and I was wondering if there was a way I could filter this output:

Frame (137 bytes):
0000  00 00 14 00 ee 18 00 00 10 6c 85 09 c0 00 dd 9c   .........l.....
0010  59 00 00 41 08 41 24 00 00 18 f8 f5 c2 c6 00 25   Y..A.A.$......%
Decrypted CCMP data (73 bytes):
0000  aa aa 03 00 00 00 08 00 45 00 00 41 8b 67 00 00  ........E..A.g..
0010  80 11 f1 40 c0 a8 01 0c d4 36 28 19 fc 82 00 35  [email protected](....5

to just the decrypted Hex:

aa aa 03 00 00 00 08 00 45 00 00 41 8b 67 00 00
80 11 f1 40 c0 a8 01 0c d4 36 28 19 fc 82 00 35

asked 21 Jul '14, 11:06

jd45093's gravatar image

jd45093
1223
accept rate: 0%