Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Short answer is: no.

The full answer may be easier to explain if you look at the command line options for text2pcap or the 'Import from Hex Dump' dialog in Wireshark. The raw data in the text file is not enough to make a dissection possible. There needs to be some more metadata added to do that. One thing is the encapsulation type, but also details about the actual formatting of the text file. All in all, this would required rolling text2pcap into tshark, something which could be done for Wireshark as an additional user interface component, but not so easy for a part reading capture files (which is in fact a separate part, called wiretap) shared between Wireshark and Tshark (which therefore can read the same capture files formats, as stated in the manual page).