I would like to get the data out of a capture in the Hex Stream format? I know I can right click and select 'Copy' and then 'as a Hex Stream' for each packet. Is there a method to apply function this to the entire file at once?
Try saving the capture as K12 text file.
Or doing File > Export Packet Dissections > As Plain Text..., select "All Packets" and "Captured", disable "Summary line" and "Details:", and enable "Bytes".
However, both of those will write out each packet's data separately, rather than just writing out the concatenated data of all packets; hopefully that's what the person who asked about this wanted.
Gentlemen, Thank you. I do want each packet as a separate line in the final text file. I am attempting to figure out how to set and get values out of a PLC without using the PLC programming software. We are trying to build a test system that automatically sets some objects in the PLC and checkes for the correct logical result.
I do want each packet as a separate line in the final text file.
Separate line, as in "one newline per packet, with all the bytes of the packet on the same line"? We don't support that.
If I read your use-case correctly, you would like to get one line per packet with the TCP data from the packet in hex format. I think the following tshark command would suit your need:
tshark -r <file> -T fields -e frame.number -e ip.src -e ip.dst -e tcp.payload
(you can of course change the fields of interest, but the field tcp.payload will print a hexdump of the TCP segment data)
When i try this i get the error that tcp.payload isn't a valid field.
Do you know how I can fix this or what else i can try? I think i just dont understand tshark well enough to find the solution
Are you version 2.4 or higher? According to https://www.wireshark.org/docs/dfref/... the tcp.payload field was added in 2.4
Comments
Just concatenate the raw octets of all packets, without regard to packet boundaries, into one giant sequence of octets, and then dump that out in hex?
What's the use case for that (including the "without regard to packet boundaries" part!)?