Text2pcap Man Instruct

Name
text2pcap - Generate a capture file from an ASCII hexdump of packets

Synopsis
text2pcap [ -h ] [ -d ] [ -q ] [ -o hex|oct|dec ] [ -l <typenum> ] [ -e <l3pid>
] [ -i <proto> ] [ -m <max-packet> ] [ -u <srcport>,<destport> ] [ -T <srcport>,
<destport> ] [ -s <srcport>,<destport>,<tag> ] [ -S <srcport>,<destport>,<ppi> ]
[ -t <timefmt> ] <infile>|- <outfile>|Description
Text2pcap is a program that reads in an ASCII hex dump and writes the data descr
ibed into a libpcap capture file. text2pcap can read hexdumps with multiple pack
ets in them, and build a capture file of multiple packets. text2pcap is also cap
able of generating dummy Ethernet, IP and UDP , TCP , or SCTP headers, in order
to build fully processable packet dumps from hexdumps of application-level data
only.
Text2pcap understands a hexdump of the form generated by od -Ax -tx1 -v. In othe
r words, each byte is individually displayed and surrounded with a space. Each l
ine begins with an offset describing the position in the file. The offset is a h
ex number (can also be octal or decimal - see -o), of more than two hex digits.
Here is a sample dump that text2pcap can recognize:
000000
000008
000010
000018
000020
000028
000030
00
5a
03
ee
03
16
01
e0
a0
68
33
80
a2
01
1e
b9
00
0f
94
0a
0f
a7
12
00
19
04
00
19
05
08
00
08
00
03
03
6f
00
00
7f
00
50
80
00
46
0a
0f
10
00
11
10
00
2e
19
01
0c
01
........
........
........
........
........
........
........
There is no limit on the width or number of bytes per line. Also the text dump a
t the end of the line is ignored. Bytes/hex numbers can be uppercase or lowercas
e. Any text before the offset is ignored, including email forwarding characters
'>'. Any lines of text between the bytestring lines is ignored. The offsets are
used to track the bytes, so offsets must be correct. Any line which has only byt
es without a leading offset is ignored. An offset is recognized as being a hex n
umber longer than two characters. Any text after the bytes is ignored (e.g. the
character dump). Any hex numbers in this text are also ignored. An offset of zer
o is indicative of starting a new packet, so a single text file with a series of
hexdumps can be converted into a packet capture with multiple packets. Multiple
packets are read in with timestamps differing by one second each. In general, s
hort of these restrictions, text2pcap is pretty liberal about reading in hexdump
s and has been tested with a variety of mangled outputs (including being forward
ed through email multiple times, with limited line wrap etc.)
There are a couple of other special features to note. Any line where the first n
on-whitespace character is '#' will be ignored as a comment. Any line beginning
with #TEXT2PCAP is a directive and options can be inserted after this command to
be processed by text2pcap. Currently there are no directives implemented; in th
e future, these may be used to give more fine grained control on the dump and th
e way it should be processed e.g. timestamps, encapsulation type etc.
Text2pcap also allows the user to read in dumps of application-level data, by in
serting dummy L2, L3 and L4 headers before each packet. The user can elect to in
sert Ethernet headers, Ethernet and IP , or Ethernet, IP and UDP/TCP headers bef
ore each packet. This allows Wireshark or any other full-packet decoder to handl
e these dumps.
Options
-h
Displays a help message.
-d
Displays debugging information during the process. Can be used multiple times to
generate more debugging information.
-q
Be completely quiet during the process.
-o hex|oct|dec
Specify the radix for the offsets (hex, octal or decimal). Defaults to hex.
This corresponds to the "-A" option for od.
-l
Specify the link-layer type of this packet. Default is Ethernet (1). See net/bpf
.h for the complete list of possible encapsulations. Note that this option shoul
d be used if your dump is a complete hex dump of an encapsulated packet and you
wish to specify the exact type of encapsulation. Example: -l 7 for ARCNet packet
s.
-e <l3pid>
Include a dummy Ethernet header before each packet. Specify the L3PID for th
e Ethernet header in hex. Use this option if your dump has Layer 3 header and pa
yload (e.g. IP header), but no Layer 2 encapsulation. Example: -e 0x806 to speci
fy an ARP packet.
For IP packets, instead of generating a fake Ethernet header you can also us
e -l 12 to indicate a raw IP packet to Wireshark. Note that -l 12 does not work
for any non-IP Layer 3 packet (e.g. ARP ), whereas generating a dummy Ethernet h
eader with -e works for any sort of L3 packet.
-i <proto>
Include dummy IP headers before each packet. Specify the IP protocol for the
packet in decimal. Use this option if your dump is the payload of an IP packet
(i.e. has complete L4 information) but does not have an IP header with each pack
et. Note that an appropriate Ethernet header is automatically included with each
packet as well. Example: -i 46 to specify an RSVP packet ( IP protocol 46).
-m <max-packet>
Set the maximum packet length, default is 64000. Useful for testing various
packet boundaries when only an application level datastream is available. Exampl
e:
od -Ax -tx1 stream | text2pcap -m1460 -T1234,1234 - stream.pcap
will convert from plain datastream format to a sequence of Ethernet TCP pack
ets.
-u <srcport>,<destport>
Include dummy UDP headers before each packet. Specify the source and destina
tion UDP ports for the packet in decimal. Use this option if your dump is the UD
P payload of a packet but does not include any UDP , IP or Ethernet headers. Not
e that appropriate Ethernet and IP headers are automatically also included with
each packet. Example: -u1000,69 to make the packets look like TFTP/UDP packets.
-T <srcport>,<destport>
Include dummy TCP headers before each packet. Specify the source and destina
tion TCP ports for the packet in decimal. Use this option if your dump is the TC
P payload of a packet but does not include any TCP , IP or Ethernet headers. Not
e that appropriate Ethernet and IP headers are automatically also included with
each packet. Sequence numbers will start at 0.
-s <srcport>,<destport>,<tag>
Include dummy SCTP headers before each packet. Specify, in decimal, the sour
ce and destination SCTP ports, and verification tag, for the packet. Use this op
tion if your dump is the SCTP payload of a packet but does not include any SCTP
, IP or Ethernet headers. Note that appropriate Ethernet and IP headers are auto
matically also included with each packet. A CRC32C checksum will be put into the
SCTP header.
-S <srcport>,<destport>,<ppi>
Include dummy SCTP headers before each packet. Specify, in decimal, the sour
ce and destination SCTP ports, and a verification tag of 0, for the packet, and
prepend a dummy SCTP DATA chunk header with a payload protocol identifier if ppi
. Use this option if your dump is the SCTP payload of a packet but does not incl
ude any SCTP , IP or Ethernet headers. Note that appropriate Ethernet and IP hea
ders are automatcally included with each packet. A CRC32C checksum will be put i
nto the SCTP header.
-t <timefmt>
Treats the text before the packet as a date/time code; timefmt is a format s
tring of the sort supported by strptime(3). Example: The time "10:15:14.5476" ha
s the format code "%H:%M:%S."
NOTE: The subsecond component delimiter must be specified (.) but no pattern
is required; the remaining number is assumed to be fractions of a second.
NOTE: Date/time fields from the current date/time are used as the default fo
r unspecified fields.

Text2pcap Man Instruct

Uploaded by

Copyright:

Available Formats

Text2pcap Man Instruct

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Text2pcap Man Instruct

Uploaded by

Copyright:

Available Formats

Name

text2pcap - Generate a capture file from an ASCII hexdump of packets

You might also like