This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Text to pcap

0

hi, i use tshark to convert a pcap file to txt file. i use this command: tshark -r input.pcap -x > output.txt How can i convert this text file (output.txt) to a pcap file? packets start by IP.

asked 14 Jul '17, 23:47

hhw's gravatar image

hhw
104711
accept rate: 100%

edited 14 Jul '17, 23:49


One Answer:

0

You can if you have the original packet bytes in the text output as well. There's the command line tool text2pcap, or you can use the 'Import from hex dump' feature from Wireshark. Make sure that the text file matches the required input, so some preprocessing of the text file may be required.

answered 15 Jul '17, 00:57

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%