Ask Your Question
0

How to read a specified packet in hex and ASCII?

asked 2020-05-09 02:06:47 +0000

SteveZhou gravatar image

Hi,

I know tcpdump has -X option to print packets in hex and ASCII. -r to give the pcap file.

but how to just to read a specific packet and/or a range of packets, not a whole while? I think there is a way to specifying filter here?

thanks!

edit retag flag offensive close merge delete

Comments

Is tshark an option or has to be tcpdump?

bubbasnmp gravatar imagebubbasnmp ( 2020-05-09 02:30:09 +0000 )edit

hi, if tshark works, that is good to know.

SteveZhou gravatar imageSteveZhou ( 2020-05-09 05:59:40 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-05-09 06:57:04 +0000

Guy Harris gravatar image

If you want to use tcpdump, the only filters you can specify are pcap filters, which are the filters that, in Wireshark, are used as "capture filters".

If you want to use TShark, the -x flag prints in hex and ASCII (unlike the tcpdump -x flag, which prints only in hex), and the -r flag specifies the file to read (just as it does in tcpdump).

For TShark, you can specify a "read filter" - which are the filters that, in Wireshark, are used as display filters - with the -Y flag if you're doing a one-pass processing of the packets or with the -R flag if you've also specified -2 to do two-pass processing. Two-pass processing takes longer, but it can, when printing packet data or evaluating filters, use information determined in the first pass. For most filters, you won't need two-pass processing.

edit flag offensive delete link more

Comments

Examples of packet range with tshark.

$ tshark -r mae1_799.pcap -Y "frame.number >= 3 && frame.number <= 5" -w new.pcap
$ tshark -r mae1_799.pcap -Y "frame.number in {3..5}" -w new.pcap
bubbasnmp gravatar imagebubbasnmp ( 2020-05-09 14:31:23 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-05-09 02:06:47 +0000

Seen: 40 times

Last updated: May 09