How to convert TcpDump output to Pcap
Previously, I have converted some TcpDump output as text to Pcap file with your help. Now I need to convert another TcpDump output to a Pcap file, but with the limited information. In this case I have only the headers, is it possible to do so?
Following is the example of what I have as a captured traffic. (I have just mask mac and IP addresses because of privacy.)
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
1509471560.944080 MAC1 > MAC2, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 23237, offset 0, flags [DF], proto TCP (6), length 60)
ip1.port1 > ip2.port2: Flags [S], cksum 0x6d2f (incorrect -> 0x0b4a), seq 1127096708, win 65535, options [mss 1460,sackOK,TS val 817985 ecr 0,nop,wscale 6], length 0
1509471561.042855 MAC2 > MAC1, ethertype IPv4 (0x0800), length 58: (tos 0x0, ttl 64, id 3107, offset 0, flags [none], proto TCP (6), length 44)
ip2.port2 > ip1.port1: Flags [S.], cksum 0x85d8 (correct), seq 449984001, ack 1127096709, win 65535, options [mss 1460], length 0
1509471561.044008 MAC1 > MAC2, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 64, id 23238, offset 0, flags [DF], proto TCP (6), length 40)
ip1.port1 > ip2.port2: Flags [.], cksum 0x6d1b (incorrect -> 0x9d95), seq 1, ack 1, win 65535, length 0
1509471561.046607 MAC1 > MAC2, ethertype IPv4 (0x0800), length 191: (tos 0x0, ttl 64, id 23239, offset 0, flags [DF], proto TCP (6), length 177)
ip1.port1 > ip2.port2: Flags [P.], cksum 0x6da4 (incorrect -> 0x98df), seq 1:138, ack 1, win 65535, length 137
Edit 1:
I have written following python script and try to generate a pcap file from my text file usinf Scapy package.
from scapy.all import *
import secrets
def generatePcapfromText(inputtxt,output):
with open (inputtxt,encoding='cp850') as input:
framenum=0
for line in input:
if "ARP" in line:
continue
if line[0].isdigit(): # line one
framenum += 1
frametime=line[:16]
srcmac= line[18:34]
dstmac= line[38:54]
# ethertype = hex(int(line[line.find('(')+1:line.find(')')], 16))
frameLen=int(line[line.find('length')+7:line.find(': (')])
frameTos=line[line.find('tos')+4:line.find(', ttl')]
frameTtl=int(line[line.find('ttl')+4:line.find(', id')])
frameId=int(line[line.find('id')+3:line.find(', offset')])
frameOffset=line[line.find('offset')+7:line.find(', flags')]
frameFlags=line[line.find('[')+1:line.find(']')]
protocol = line[line.find('proto')+6:line.rfind('(')-1]
ipLen = int(line[line.rfind('length')+6:line.rfind(')')])
ether = Ether(dst=dstmac, src=srcmac, type=0x0800)
elif len(line)>5:
if line[5].isdigit(): # line two
srcinfo = line[4:line.find ( '>' )]
dstinfo = line[line.find ( '>' ) + 1:line.find ( ':' )]
ipsrc = srcinfo[:srcinfo.rfind ( '.' )]
ipdst = dstinfo[:dstinfo.rfind ( '.' )]
srcport = int(srcinfo[srcinfo.rfind ( '.' ) + 1:])
dstport = int(dstinfo[dstinfo.rfind ( '.' ) + 1:])
*** ip = ether/IP(src=ipsrc, dst=ipdst, len=frameLen, tos=frameTos, ttl=frameTtl,
id=frameId, flags=frameFlags, proto=protocol.lower())
if protocol == "TCP":
frameFlag = line[line ...
Are you the one running tcpdump? If so you can use -w <filename> to write to a PCAP file directly.
And I might save you some pain by suggesting you use
-s 0
(snaplen) so you capture the whole packet.@Spooky They are some traffic captured in past, and I wana to have some pcap for them.