Wireshark tools — text2pcap

这篇文章主要是为了介绍一下wireshark自带的小工具text2pcap,这个小工具可以帮助我们将16进制的文件转换为pcap文件,让我们可以直接在wireshark中打开。

 

转换过程

打开wireshark的安装目录,在安装目录下新建一个txt文档,如下图所示:

将16进制的数据按下图格式进行整合,注意前6个字节一定要对应MAC地址,要不然转换会出错:

打开CMD命令行,进入wireshark安装的根目录,进行转换.如下:

Microsoft Windows [版本 10.0.17134.407]
(c) 2018 Microsoft Corporation。保留所有权利。

C:\Users\xuxing>D:

D:\>cd D:\Wireshark

D:\Wireshark>
D:\Wireshark>
D:\Wireshark>text2pcap.exe 12_19.txt 12_19.pcap
Input from: 12_19.txt
Output to: 12_19.pcap
Output format: PCAP
Wrote packet of 64 bytes.
Read 1 potential packet, wrote 1 packet (104 bytes).

再次查看wireshark安装的根目录,包含刚刚所转换的文件了:

参考以下文档:

https://www.wireshark.org/docs/man-pages/text2pcap.html

           

No comments

Comments feed for this article

Reply

Your email address will not be published. Required fields are marked *