Ask Your Question

Revision history [back]

Text2pcap: it gives the original unedited pcap in output

Hello!

I am doing the following:

  1. I select the stream to follow in Wireshark, I go to File -> Export packet Dissections -> As Plain Text.
  2. Then, I select Bytes only in Packet format and save it in a text file.
  3. I then edit the text file to update the hex and corresponding text (4 Bytes) and save it.
  4. I then run text2pcap mytexttfile.txt output.pcap and for some reason output.pcap still has the original unedited content.

I checked the text file multiple times to make sure the edits were made and did the entire process multiple times to be sure that I was writing to the correct file.

What am I doing incorrectly? Thank You!

If it helps, I'm using Text2pcap (Wireshark) 3.6.2 (Git v3.6.2 packaged as 3.6.2-2).