Hallo, dies ist ein Test.
PWD: /www/data-lst1/unixsoft/unixsoft/kaempfer/.public_html
Running in File Mode
Relative path: ./../../../../../../usr/share/wireshark/text2pcap.html
Real path: /usr/share/wireshark/text2pcap.html
Zurück
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="generator" content="Asciidoctor 2.0.20"> <title>text2pcap(1)</title> <link rel="stylesheet" href="./ws.css"> </head> <body class="manpage"> <div id="header"> <h1>text2pcap(1) Manual Page</h1> <h2 id="_name">NAME</h2> <div class="sectionbody"> <p>text2pcap - Generate a capture file from an ASCII hexdump of packets</p> </div> </div> <div id="content"> <div class="sect1"> <h2 id="_synopsis">SYNOPSIS</h2> <div class="sectionbody"> <div class="paragraph"> <p><span class="nowrap"><strong>text2pcap</strong></span> <span class="nowrap">[ <strong>-a</strong> ]</span> <span class="nowrap">[ <strong>-b</strong> 2|8|16|64 ]</span> <span class="nowrap">[ <strong>-D</strong> ]</span> <span class="nowrap">[ <strong>-e</strong> <l3pid> ]</span> <span class="nowrap">[ <strong>-E</strong> <encapsulation type> ]</span> <span class="nowrap">[ <strong>-F</strong> <file format> ]</span> <span class="nowrap">[ <strong>-h</strong> ]</span> <span class="nowrap">[ <strong>-i</strong> <proto> ]</span> <span class="nowrap">[ <strong>-l</strong> <typenum> ]</span> <span class="nowrap">[ <strong>-N</strong> <intf-name> ]</span> <span class="nowrap">[ <strong>-m</strong> <max-packet> ]</span> <span class="nowrap">[ <strong>-o</strong> hex|oct|dec|none ]</span> <span class="nowrap">[ <strong>-q</strong> ]</span> <span class="nowrap">[ <strong>-r</strong> <regex> ]</span> <span class="nowrap">[ <strong>-s</strong> <srcport>,<destport>,<tag> ]</span> <span class="nowrap">[ <strong>-S</strong> <srcport>,<destport>,<ppi> ]</span> <span class="nowrap">[ <strong>-t</strong> <timefmt> ]</span> <span class="nowrap">[ <strong>-T</strong> <srcport>,<destport> ]</span> <span class="nowrap">[ <strong>-u</strong> <srcport>,<destport> ]</span> <span class="nowrap">[ <strong>-v</strong> ]</span> <span class="nowrap">[ <strong>-4</strong> <srcip>,<destip> ]</span> <span class="nowrap">[ <strong>-6</strong> <srcip>,<destip> ]</span> <span class="nowrap"><<em>infile</em>>|-</span> <span class="nowrap"><<em>outfile</em>>|-</span></p> </div> </div> </div> <div class="sect1"> <h2 id="_description">DESCRIPTION</h2> <div class="sectionbody"> <div class="paragraph"> <p><strong>Text2pcap</strong> is a program that reads in an ASCII hex dump and writes the data described into a capture file. <strong>text2pcap</strong> can read hexdumps with multiple packets in them, and build a capture file of multiple packets. <strong>Text2pcap</strong> is also capable of generating dummy Ethernet, IP, and UDP, TCP or SCTP headers, in order to build fully processable packet dumps from hexdumps of application-level data only.</p> </div> <div class="paragraph"> <p><strong>Text2pcap</strong> can write the file in several output formats. The <strong>-F</strong> flag can be used to specify the format in which to write the capture file, <strong>text2pcap -F</strong> provides a list of the available output formats. By default, it writes the packets to <em>outfile</em> in the <strong>pcapng</strong> file format.</p> </div> <div class="paragraph"> <p><strong>Text2pcap</strong> understands a hexdump of the form generated by <em>od -Ax -tx1 -v</em>. In other words, each byte is individually displayed, with spaces separating the bytes from each other. Hex digits can be upper or lowercase.</p> </div> <div class="paragraph"> <p>In normal operation, each line must begin with an offset describing the position in the packet, followed a colon, space, or tab separating it from the bytes. There is no limit on the width or number of bytes per line, but lines with only hex bytes without a leading offset are ignored (in other words, line breaks should not be inserted in long lines that wrap.) Offsets are more than two digits; they are in hex by default, but can also be in octal or decimal - see <strong>-o</strong>. Each packet must begin with offset zero, and an offset zero indicates the beginning of a new packet. Offset values must be correct; an unexpected value causes the current packet to be aborted and the next packet start awaited. There is also a single packet mode with no offsets; see <strong>-o</strong>.</p> </div> <div class="paragraph"> <p>Packets may be preceded by a direction indicator ('I' or 'O') and/or a timestamp if indicated by the command line (see <strong>-D</strong> and <strong>-t</strong>). If both are present, the direction indicator precedes the timestamp. The format of the timestamps is specified as a mandatory parameter to <strong>-t</strong>. If no timestamp is parsed, in the case of the first packet the current system time is used, while subsequent packets are written with timestamps one microsecond later than that of the previous packet.</p> </div> <div class="paragraph"> <p>Other text in the input data is ignored. Any text before the offset is ignored, including email forwarding characters '>'. Any text on a line after the bytes is ignored, e.g. an ASCII character dump (but see <strong>-a</strong> to ensure that hex digits in the character dump are ignored). Any line where the first non-whitespace character is a '#' will be ignored as a comment. Any lines of text between the bytestring lines are considered preamble; the beginning of the preamble is scanned for the direction indicator and timestamp as mentioned above and otherwise ignored.</p> </div> <div class="paragraph"> <p>Any line beginning with #TEXT2PCAP is a directive and options can be inserted after this command to be processed by <strong>text2pcap</strong>. Currently there are no directives implemented; in the future, these may be used to give more fine grained control on the dump and the way it should be processed e.g. timestamps, encapsulation type etc.</p> </div> <div class="paragraph"> <p>In general, short of these restrictions, <strong>text2pcap</strong> is pretty liberal about reading in hexdumps and has been tested with a variety of mangled outputs (including being forwarded through email multiple times, with limited line wrap etc.)</p> </div> <div class="paragraph"> <p>Here is a sample dump that <strong>text2pcap</strong> can recognize, with optional directional indicator and timestamp:</p> </div> <div class="literalblock"> <div class="content"> <pre>I 2019-05-14T19:04:57Z 000000 00 0e b6 00 00 02 00 0e b6 00 00 01 08 00 45 00 000010 00 28 00 00 00 00 ff 01 37 d1 c0 00 02 01 c0 00 000020 02 02 08 00 a6 2f 00 01 00 01 48 65 6c 6c 6f 20 000030 57 6f 72 6c 64 21 000036</pre> </div> </div> <div class="paragraph"> <p><strong>Text2pcap</strong> is also capable of scanning a text input file using a custom Perl compatible regular expression that matches a single packet. <strong>text2pcap</strong> searches the given file (which must end with '\n') for non-overlapping non-empty strings matching the regex. Named capturing subgroups, which must match exactly once per packet, are used to identify fields to import. The following fields are supported in regex mode, one mandatory and three optional:</p> </div> <div class="literalblock"> <div class="content"> <pre>"data" Actual captured frame data to import "time" Timestamp of packet "dir" Direction of packet "seqno" Arbitrary ID of packet</pre> </div> </div> <div class="paragraph"> <p>The 'data' field is the captured data, which must be in a selected encoding: hexadecimal (the default), octal, binary, or base64 and containing no characters in the data field outside the encoding set besides whitespace. The 'time' field is parsed according to the format in the <strong>-t</strong> parameter. The first character of the 'dir' field is compared against a set of characters corresponding to inbound and outbound that default to "iI<" for inbound and "oO>" for outbound to assign a direction. The 'seqno' field is assumed to be a positive integer base 10 used for an arbitrary ID. An optional field’s information will only be written if the field is present in the regex and if the capture file format supports it. (E.g., the pcapng format supports all three fields, but the pcap format only supports timestamps.)</p> </div> <div class="paragraph"> <p>Here is a sample dump that the regex mode can process with the regex '^(?<dir>[<>])\s(?<time>\d+:\d\d:\d\d.\d+)\s(?<data>[0-9a-fA-F]+)$' along with timestamp format '%H:%M:%S.%f', directional indications of '<' and '>', and hex encoding:</p> </div> <div class="literalblock"> <div class="content"> <pre>> 0:00:00.265620 a130368b000000080060 > 0:00:00.280836 a1216c8b00000000000089086b0b82020407 < 0:00:00.295459 a2010800000000000000000800000000 > 0:00:00.296982 a1303c8b00000008007088286b0bc1ffcbf0f9ff > 0:00:00.305644 a121718b0000000000008ba86a0b8008 < 0:00:00.319061 a2010900000000000000001000600000 > 0:00:00.330937 a130428b00000008007589186b0bb9ffd9f0fdfa3eb4295e99f3aaffd2f005 > 0:00:00.356037 a121788b0000000000008a18</pre> </div> </div> <div class="paragraph"> <p>The regex is compiled with multiline support, and it is recommended to use the anchors '^' and '$' for best results.</p> </div> <div class="paragraph"> <p><strong>Text2pcap</strong> also allows the user to read in dumps of application-level data and insert dummy L2, L3 and L4 headers before each packet. This allows Wireshark or any other full-packet decoder to handle these dumps. If the encapsulation type is Ethernet, the user can elect to insert Ethernet headers, Ethernet and IP, or Ethernet, IP and UDP/TCP/SCTP headers before each packet. The fake headers can also be used with the Raw IP, Raw IPv4, or Raw IPv6 encapsulations, with the Ethernet header omitted. These encapsulation options can be used in both hexdump mode and regex mode.</p> </div> <div class="paragraph"> <p>When <<em>infile</em>> or <<em>outfile</em>> are '-', standard input or standard output, respectively, are used.</p> </div> </div> </div> <div class="sect1"> <h2 id="_options">OPTIONS</h2> <div class="sectionbody"> <div class="dlist"> <dl> <dt class="hdlist1">-a</dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Enables ASCII text dump identification. It allows one to identify the start of the ASCII text dump and not include it in the packet even if it looks like HEX. This parameter has no effect in regex mode.</p> </div> <div class="paragraph"> <p><strong>NOTE:</strong> Do not enable it if the input file does not contain the ASCII text dump.</p> </div> </div> </div> </dd> <dt class="hdlist1">-b 2|8|16|64</dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Specify the base (radix) of the encoding of the packet data in regex mode. The supported options are 2 (binary), 8 (octal), 16 (hexadecimal), and 64 (base64 encoding), with hex as the default. This parameter has no effect in hexdump mode.</p> </div> </div> </div> </dd> <dt class="hdlist1">-D</dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Indicates that the text before each input packet may start either with an I or O indicating that the packet is inbound or outbound. If both this flag and the <em>t</em> flag are used, the directional indicator is expected before the time code. This parameter has no effect in regex mode, where the presence of the <code><dir></code> capturing group determines whether direction indicators are expected.</p> </div> <div class="paragraph"> <p>Direction indication is stored in the packet headers if the output format supports it (e.g. pcapng), and is also used when generating dummy headers to swap the source and destination addresses and ports as appropriate.</p> </div> </div> </div> </dd> <dt class="hdlist1">-e <l3pid></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Include a dummy Ethernet header before each packet. Specify the L3PID for the Ethernet header in hex. Use this option if your dump has Layer 3 header and payload (e.g. IP header), but no Layer 2 encapsulation. Example: <em>-e 0x806</em> to specify an ARP packet.</p> </div> <div class="paragraph"> <p>For IP packets, instead of generating a fake Ethernet header you can also use <em>-E rawip</em> or <em>-l 101</em> to indicate raw IP encapsulation. Note that raw IP encapsulation does not work for any non-IP Layer 3 packet (e.g. ARP), whereas generating a dummy Ethernet header with <em>-e</em> works for any sort of L3 packet.</p> </div> </div> </div> </dd> <dt class="hdlist1">-E <encapsulation type></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Sets the packet encapsulation type of the output capture file. <strong>text2pcap -E</strong> provides a list of the available types; note that not all file formats support all encapsulation types. The default type is ether (Ethernet).</p> </div> <div class="paragraph"> <p><strong>NOTE:</strong> This sets the encapsulation type of the output file, but does not translate the packet headers or add additional headers. It is used to specify the encapsulation that matches the input data.</p> </div> </div> </div> </dd> <dt class="hdlist1">-F <file format></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Sets the file format of the output capture file. <strong>Text2pcap</strong> can write the file in several formats; <strong>text2pcap -F</strong> provides a list of the available output formats. The default is the <strong>pcapng</strong> format.</p> </div> </div> </div> </dd> <dt class="hdlist1">-h</dt> <dd> <p>Displays a help message.</p> </dd> <dt class="hdlist1">-i <proto></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Include dummy IP headers before each packet. Specify the IP protocol for the packet in decimal. Use this option if your dump is the payload of an IP packet (i.e. has complete L4 information) but does not have an IP header with each packet. Note that an appropriate Ethernet header is automatically included with each packet as well if the link-layer type is Ethernet. Example: <em>-i 46</em> to specify an RSVP packet (IP protocol 46). See <a href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml" class="bare">https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml</a> for the complete list of assigned internet protocol numbers.</p> </div> </div> </div> </dd> <dt class="hdlist1">-l <typenum></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Sets the packet encapsulation type of the output capture file, using pcap link-layer header type numbers. Default is Ethernet (1). See <a href="https://www.tcpdump.org/linktypes.html" class="bare">https://www.tcpdump.org/linktypes.html</a> for the complete list of possible encapsulations. Example: <em>-l 7</em> for ARCNet packets encapsulated BSD-style.</p> </div> </div> </div> </dd> <dt class="hdlist1">-m <max-packet></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Set the maximum packet length, default is 262144. Useful for testing various packet boundaries when only an application level datastream is available. Example:</p> </div> <div class="paragraph"> <p><em>od -Ax -tx1 -v stream | text2pcap -m1460 -T1234,1234 - stream.pcap</em></p> </div> <div class="paragraph"> <p>will convert from plain datastream format to a sequence of Ethernet TCP packets.</p> </div> </div> </div> </dd> <dt class="hdlist1">-N <intf-name></dt> <dd> <p>Specify a name for the interface included when writing a pcapng format file.</p> </dd> <dt class="hdlist1">-o hex|oct|dec|none</dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Specify the radix for the offsets (hex, octal, decimal, or none). Defaults to hex. This corresponds to the <code>-A</code> option for <em>od</em>. This parameter has no effect in regex mode.</p> </div> <div class="paragraph"> <p><strong>NOTE:</strong> With <em>-o none</em>, only one packet will be created, ignoring any direction indicators or timestamps after the first byte along with any offsets.</p> </div> </div> </div> </dd> <dt class="hdlist1">-P <dissector></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Include an EXPORTED_PDU header before each packet. Specify, as a string, the dissector to be called for the packet (DISSECTOR_NAME tag). Use this option if your dump is the payload for a single upper layer protocol (so specifying a link layer type would not work) and you wish to create a capture file without a full dummy protocol stack. Automatically sets the link layer type to Wireshark Upper PDU export. Without this option, if the Upper PDU export link layer type (252) is selected the dissector defaults to "data".</p> </div> </div> </div> </dd> <dt class="hdlist1">-q</dt> <dd> <p>Don’t display the summary of the options selected at the beginning, or the count of packets processed at the end.</p> </dd> <dt class="hdlist1">-r <regex></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Process the file in regex mode using <em>regex</em> as described above.</p> </div> <div class="paragraph"> <p><strong>NOTE:</strong> The regex mode uses memory-mapped I/O and does not work on streams that do not support seeking, like terminals and pipes.</p> </div> </div> </div> </dd> <dt class="hdlist1">-s <srcport>,<destport>,<tag></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Include dummy SCTP headers before each packet. Specify, in decimal, the source and destination SCTP ports, and verification tag, for the packet. Use this option if your dump is the SCTP payload of a packet but does not include any SCTP, IP or Ethernet headers. Note that appropriate Ethernet and IP headers are automatically also included with each packet. A CRC32C checksum will be put into the SCTP header.</p> </div> </div> </div> </dd> <dt class="hdlist1">-S <srcport>,<destport>,<ppi></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Include dummy SCTP headers before each packet. Specify, in decimal, the source and destination SCTP ports, and a verification tag of 0, for the packet, and prepend a dummy SCTP DATA chunk header with a payload protocol identifier if <em>ppi</em>. Use this option if your dump is the SCTP payload of a packet but does not include any SCTP, IP or Ethernet headers. Note that appropriate Ethernet and IP headers are automatically included with each packet. A CRC32C checksum will be put into the SCTP header.</p> </div> </div> </div> </dd> <dt class="hdlist1">-t <timefmt></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Treats the text before the packet as a date/time code; <em>timefmt</em> is a format string supported by strftime(3), supplemented with the field descriptor '%f' for fractional seconds up to nanoseconds. Example: The time "10:15:14.5476" has the format code "%H:%M:%S.%f" The special format string <em>ISO</em> indicates that the string should be parsed according to the ISO-8601 specification. This parameter is used in regex mode if and only if the <code><time></code> capturing group is present.</p> </div> <div class="paragraph"> <p><strong>NOTE:</strong> Date/time fields from the current date/time are used as the default for unspecified fields.</p> </div> </div> </div> </dd> <dt class="hdlist1">-T <srcport>,<destport></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Include dummy TCP headers before each packet. Specify the source and destination TCP ports for the packet in decimal. Use this option if your dump is the TCP payload of a packet but does not include any TCP, IP or Ethernet headers. Note that appropriate Ethernet and IP headers are automatically also included with each packet. Sequence numbers will start at 0.</p> </div> </div> </div> </dd> <dt class="hdlist1">-u <srcport>,<destport></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Include dummy UDP headers before each packet. Specify the source and destination UDP ports for the packet in decimal. Use this option if your dump is the UDP payload of a packet but does not include any UDP, IP or Ethernet headers. Note that appropriate Ethernet and IP headers are automatically also included with each packet. Example: <em>-u1000,69</em> to make the packets look like TFTP/UDP packets.</p> </div> </div> </div> </dd> <dt class="hdlist1">-v</dt> <dd> <p>Print the version and exit.</p> </dd> <dt class="hdlist1">-4 <srcip>,<destip></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Prepend dummy IP header with specified IPv4 dest and source address. This option should be accompanied by one of the following options: -i, -s, -S, -T, -u Use this option to apply "custom" IP addresses. Example: <em>-4 10.0.0.1,10.0.0.2</em> to use 10.0.0.1 and 10.0.0.2 for all IP packets.</p> </div> </div> </div> </dd> <dt class="hdlist1">-6 <srcip>,<destip></dt> <dd> <div class="openblock"> <div class="content"> <div class="paragraph"> <p>Prepend dummy IP header with specified IPv6 dest and source address. This option should be accompanied by one of the following options: -i, -s, -S, -T, -u Use this option to apply "custom" IP addresses. Example: <em>-6 2001:db8::b3ff:fe1e:8329,2001:0db8:85a3::8a2e:0370:7334</em> to use 2001:db8::b3ff:fe1e:8329 and 2001:0db8:85a3::8a2e:0370:7334 for all IP packets.</p> </div> </div> </div> </dd> </dl> </div> </div> </div> <div class="sect1"> <h2 id="_diagnostic_options">DIAGNOSTIC OPTIONS</h2> <div class="sectionbody"> <div class="dlist"> <dl> <dt class="hdlist1">--log-level <level></dt> <dd> <p>Set the active log level. Supported levels in lowest to highest order are "noisy", "debug", "info", "message", "warning", "critical", and "error". Messages at each level and higher will be printed, for example "warning" prints "warning", "critical", and "error" messages and "noisy" prints all messages. Levels are case insensitive.</p> </dd> <dt class="hdlist1">--log-fatal <level></dt> <dd> <p>Abort the program if any messages are logged at the specified level or higher. For example, "warning" aborts on any "warning", "critical", or "error" messages.</p> </dd> </dl> </div> <div class="dlist"> <dl> <dt class="hdlist1">--log-domains <list></dt> <dd> <p>Only print messages for the specified log domains, e.g. "GUI,Epan,sshdump". List of domains must be comma-separated.</p> </dd> <dt class="hdlist1">--log-debug <list></dt> <dd> <p>Force the specified domains to log at the "debug" level. List of domains must be comma-separated.</p> </dd> <dt class="hdlist1">--log-noisy <list></dt> <dd> <p>Force the specified domains to log at the "noisy" level. List of domains must be comma-separated.</p> </dd> <dt class="hdlist1">--log-file <path></dt> <dd> <p>Write log messages and stderr output to the specified file.</p> </dd> </dl> </div> </div> </div> <div class="sect1"> <h2 id="_see_also">SEE ALSO</h2> <div class="sectionbody"> <div class="paragraph"> <p>od(1), <a href="https://www.tcpdump.org/manpages/pcap.3pcap.html">pcap</a>(3), <a href="wireshark.html">wireshark</a>(1), <a href="tshark.html">tshark</a>(1), <a href="dumpcap.html">dumpcap</a>(1), <a href="mergecap.html">mergecap</a>(1), <a href="editcap.html">editcap</a>(1), strftime(3), <a href="https://www.tcpdump.org/manpages/pcap-filter.7.html">pcap-filter</a>(7) or <a href="https://www.tcpdump.org/manpages/tcpdump.1.html">tcpdump</a>(8)</p> </div> </div> </div> <div class="sect1"> <h2 id="_notes">NOTES</h2> <div class="sectionbody"> <div class="paragraph"> <p>This is the manual page for <strong>Text2pcap</strong> 4.0.8. <strong>Text2pcap</strong> is part of the <strong>Wireshark</strong> distribution. The latest version of <strong>Wireshark</strong> can be found at <a href="https://www.wireshark.org" class="bare">https://www.wireshark.org</a>.</p> </div> </div> </div> <div class="sect1"> <h2 id="_authors">AUTHORS</h2> <div class="sectionbody"> <div class="paragraph"> <div class="title">Original Author</div> <p>Ashok Narayanan <ashokn[AT]cisco.com></p> </div> </div> </div> </div> </body> </html>