Ask Your Question

How to read a specified packet in hex and ASCII?

asked 2020-05-09 02:06:47 +0000

SteveZhou gravatar image


I know tcpdump has -X option to print packets in hex and ASCII. -r to give the pcap file.

but how to just to read a specific packet and/or a range of packets, not a whole while? I think there is a way to specifying filter here?


edit retag flag offensive close merge delete


Is tshark an option or has to be tcpdump?

Chuckc gravatar imageChuckc ( 2020-05-09 02:30:09 +0000 )edit

hi, if tshark works, that is good to know.

SteveZhou gravatar imageSteveZhou ( 2020-05-09 05:59:40 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-05-09 06:57:04 +0000

Guy Harris gravatar image

If you want to use tcpdump, the only filters you can specify are pcap filters, which are the filters that, in Wireshark, are used as "capture filters".

If you want to use TShark, the -x flag prints in hex and ASCII (unlike the tcpdump -x flag, which prints only in hex), and the -r flag specifies the file to read (just as it does in tcpdump).

For TShark, you can specify a "read filter" - which are the filters that, in Wireshark, are used as display filters - with the -Y flag if you're doing a one-pass processing of the packets or with the -R flag if you've also specified -2 to do two-pass processing. Two-pass processing takes longer, but it can, when printing packet data or evaluating filters, use information determined in the first pass. For most filters, you won't need two-pass processing.

edit flag offensive delete link more


Examples of packet range with tshark.

$ tshark -r mae1_799.pcap -Y "frame.number >= 3 && frame.number <= 5" -w new.pcap
$ tshark -r mae1_799.pcap -Y "frame.number in {3..5}" -w new.pcap
Chuckc gravatar imageChuckc ( 2020-05-09 14:31:23 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-05-09 02:06:47 +0000

Seen: 1,952 times

Last updated: May 09 '20