How do I extract the hex section from a pcap file?
for homework, i was given a captured pcap file from a USB and was told to identify a 'flag' which it contains.
I've researched the right code (Tshark) to use for this, however, I don't know what field to refer to in order to extract the flag from it - I feel like it would be the hexadecimal values that need to be extracted for the contents of the USB but I don't know how to refer to it when using tshark.
tshark -r targetFile.pcapng -T fields -e _ws.col.Info > outFile.csv
here is the code I have, the -e is referring to the 'info' column of Wireshark but I want to extract the hex values at the bottom, what is the correct syntax for this?
please thank you