How to store raw hexdump as a pcap file?

asked 2019-12-05 10:48:56 +0000

Ashok
1 ●1 ●1

I want to store a raw hexdump into a .pcap file instead of a .txt file. Is there any header/format that is available which i can use, so that the raw hexdump along with the special header/format can be read as a pcap file by Wireshark.

Basically, i need the backend or functionality of the "Import from hexdump" option so that i can use it on a hexdump file to open it as a pcap file. Any help is much appreciated.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-12-05 11:27:56 +0000

Jaap

13742 ●711 ●115

You could easily whip something together using this information on the pcap file format.

edit flag offensive delete link

add a comment

answered 2019-12-05 10:54:25 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

Have a look at Text2pcap which does exactly that, and more besides.

edit flag offensive delete link

Comments

Is it possible to use this in a C code?

Ashok ( 2019-12-05 11:01:20 +0000 )edit

You can either call text2pcap directly from your C application, or, if you observe the licence for text2pcap (GPL v2.0 or later) then re-use the code in text2pcap to achieve the same but note that it has dependencies on other parts of the wireshark suite.

grahamb ( 2019-12-05 11:25:56 +0000 )edit

add a comment