0 i hv written code to reverse the hex dump in the C language, but i observed the output like this ∟ o e ∞ m @ ☻ Ñ N ╢ 2 E ( δ à ≥ ♠ Σ M ╤ ‼ e j └ ¿ ☺ ╓ ☺ ╗ └ J d ¿ σ * k · ½ ♥ P ► D p O æ ∟ o e ∞ m @ ☻ Ñ N ╢ 2 E ☻ s δ ë ≥ ♠ ß ■ ╤ ‼ e j └ ¿ ☺ ╓ ☺ ╗ └ J d ¿ σ * k · ½ ♥ P ↑ D p n ♀ ↨ ♥ ☺ ☻ F ⌠ N how do i get the exact data. asked 13 Jun '11, 21:33  sagu072 |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
0
Great ! Your getting somewhere, but what do you mean by "reverse the Hex Dump" ! ?
Put all the date back to front, or undo the Compilation ?
Geoff Gus Stacey
[email protected]
the data stored from wireshark is in hex format so i jus reversed to ascii.
That will do you no good as it's a binary format(Hex). You can print to file if you want to have the decoded output,
If by "the data stored from Wireshark" you mean the capture file from Wireshark, it is, as noted, a binary file, and a bunch of us have already written several programs that display the packet data in ASCII. Those programs have names such as "Wireshark" and "TShark". :-)
Doing the work Wireshark and TShark do - or even that tcpdump does - is a significant amount of work. You need to handle the details of pcap or pcap-ng format (or use libpcap/WinPcap to read the file), and then decode the packet data.