Ask Your Question

Is it possible to "Copy as Hex Stream" for the whole capture?

asked 2019-09-04 11:00:31 +0000

tstevic gravatar image

I would like to get the data out of a capture in the Hex Stream format? I know I can right click and select 'Copy' and then 'as a Hex Stream' for each packet. Is there a method to apply function this to the entire file at once?

edit retag flag offensive close merge delete


Just concatenate the raw octets of all packets, without regard to packet boundaries, into one giant sequence of octets, and then dump that out in hex?

What's the use case for that (including the "without regard to packet boundaries" part!)?

Guy Harris gravatar imageGuy Harris ( 2019-09-04 21:08:00 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted

answered 2019-09-06 09:10:57 +0000

SYN-bit gravatar image

If I read your use-case correctly, you would like to get one line per packet with the TCP data from the packet in hex format. I think the following tshark command would suit your need:

tshark -r <file> -T fields -e frame.number -e ip.src -e ip.dst -e tcp.payload

(you can of course change the fields of interest, but the field tcp.payload will print a hexdump of the TCP segment data)

edit flag offensive delete link more


When i try this i get the error that tcp.payload isn't a valid field.

Do you know how I can fix this or what else i can try? I think i just dont understand tshark well enough to find the solution

Bram gravatar imageBram ( 2020-08-11 09:03:45 +0000 )edit

Are you version 2.4 or higher? According to the tcp.payload field was added in 2.4

SYN-bit gravatar imageSYN-bit ( 2020-08-13 13:37:49 +0000 )edit

answered 2019-09-04 15:05:30 +0000

Jaap gravatar image

Try saving the capture as K12 text file.

edit flag offensive delete link more


Or doing File > Export Packet Dissections > As Plain Text..., select "All Packets" and "Captured", disable "Summary line" and "Details:", and enable "Bytes".

However, both of those will write out each packet's data separately, rather than just writing out the concatenated data of all packets; hopefully that's what the person who asked about this wanted.

Guy Harris gravatar imageGuy Harris ( 2019-09-04 23:04:22 +0000 )edit

Gentlemen, Thank you. I do want each packet as a separate line in the final text file. I am attempting to figure out how to set and get values out of a PLC without using the PLC programming software. We are trying to build a test system that automatically sets some objects in the PLC and checkes for the correct logical result.

tstevic gravatar imagetstevic ( 2019-09-05 12:29:04 +0000 )edit

I do want each packet as a separate line in the final text file.

Separate line, as in "one newline per packet, with all the bytes of the packet on the same line"? We don't support that.

Guy Harris gravatar imageGuy Harris ( 2019-09-05 19:17:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-09-04 11:00:31 +0000

Seen: 3,730 times

Last updated: Sep 06 '19