 | 1 | initial version |
To convert only a part of a given line form hex to ascii I suggest to use a Perl one-liner.
The default separator for fields is a tab character. So split by tab and process the date and data separately. For example this way:
TZ= tshark -r test.pcap -T fields -e frame.time -e data | perl -ne '($date, $hexstr) = split("\t"); print substr($date, 13, 8), "\t", (pack "H*", $hexstr), "\r\n";'
| | 2 | No.2 Revision |
To convert only a part of a given line form hex to ascii I suggest to use a Perl one-liner.
The default separator for fields is a tab character. So split by tab and process the date and data separately. For example this way:
TZ= tshark -r test.pcap -T fields -e frame.time -e data | perl -ne '($date, 's/\s+$//; ($date, $hexstr) = split("\t"); print substr($date, 13, 8), "\t", (pack "H*", $hexstr), "\r\n";'
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.