I would like to get the data out of a capture in the Hex Stream format? I know I can right click and select 'Copy' and then 'as a Hex Stream' for each packet. Is there a method to apply function this to the entire file at once?
If I read your use-case correctly, you would like to get one line per packet with the TCP data from the packet in hex format. I think the following tshark command would suit your need:
tshark -r <file> -T fields -e frame.number -e ip.src -e ip.dst -e tcp.payload
(you can of course change the fields of interest, but the field tcp.payload will print a hexdump of the TCP segment data)
Are you version 2.4 or higher? According to https://www.wireshark.org/docs/dfref/... the tcp.payload field was added in 2.4
Try saving the capture as K12 text file.
Or doing File > Export Packet Dissections > As Plain Text..., select "All Packets" and "Captured", disable "Summary line" and "Details:", and enable "Bytes".
However, both of those will write out each packet's data separately, rather than just writing out the concatenated data of all packets; hopefully that's what the person who asked about this wanted.
Gentlemen, Thank you. I do want each packet as a separate line in the final text file. I am attempting to figure out how to set and get values out of a PLC without using the PLC programming software. We are trying to build a test system that automatically sets some objects in the PLC and checkes for the correct logical result.
I do want each packet as a separate line in the final text file.
Separate line, as in "one newline per packet, with all the bytes of the packet on the same line"? We don't support that.
Asked: 2019-09-04 11:00:31 +0000
Seen: 3,623 times
Last updated: Sep 06 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
Just concatenate the raw octets of all packets, without regard to packet boundaries, into one giant sequence of octets, and then dump that out in hex?
What's the use case for that (including the "without regard to packet boundaries" part!)?