First time here? Check out the FAQ!

Ask Your Question
0

How do I extract the hex section from a pcap file?

asked Nov 12 '19

a__lmonkey gravatar image

updated Nov 12 '19

for homework, i was given a captured pcap file from a USB and was told to identify a 'flag' which it contains.

I've researched the right code (Tshark) to use for this, however, I don't know what field to refer to in order to extract the flag from it - I feel like it would be the hexadecimal values that need to be extracted for the contents of the USB but I don't know how to refer to it when using tshark.

tshark -r targetFile.pcapng -T fields -e _ws.col.Info > outFile.csv

here is the code I have, the -e is referring to the 'info' column of Wireshark but I want to extract the hex values at the bottom, what is the correct syntax for this?

please thank you

Preview: (hide)

2 Answers

Sort by » oldest newest most voted
1

answered Nov 13 '19

grahamb gravatar image

updated Nov 13 '19

cmaynard gravatar image

Extra fields are specified in the command by adding a -e argument with the field name, use multiple -e field.name arguments for multiple fields. You can find the field name in the GUI by selecting the field of interest in the packet details pane and looking at the info in the status bar at the bottom left. The field name is in parentheses.

Preview: (hide)
link
0

answered Nov 13 '19

Chuckc gravatar image

" I want to extract the hex values at the bottom"

https://www.wireshark.org/docs/man-pa...

-x
Cause TShark to print a hex and ASCII dump of the packet data after printing the summary and/or details, if either are also being displayed.
Preview: (hide)
link

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: Nov 12 '19

Seen: 3,869 times

Last updated: Nov 13 '19