For learning purposes I would like to analyse my handwritten, hex Ethernet packages with Wireshark. I've tried to write hex values into a text file and import them into Wireshark, but the program doesn't display anything.

How is it possible to analyze keyboard input with Wireshark?

  • that's quite extreme but I like it. If you want to do that then what you can do is export a really simple file from wireshark, then learn its structure, then write it in, copying it, then see if it works. If it doesn't then open it in a hex editor and compare it with what is in the original file, and you will see where your mistakes were.
    – barlop
    Jan 11 '17 at 11:45
  • you will need to use a basic troubleshooting technique, where when u have A and B, where A doesn't work and B works, and they're similar such that certain changes transform between A and B, So in ur case, A is the handwritten 1 and B is the simple exported 1. Then if u want 2 find out y A doesn't work and B works, then you can go about it in 2 ways. You can try 2 transform A into being more like B, or you can try to transform B into being more like A.. or u can do both and meet some midpoint that works. And when u reach that, then u can know n test further,find where u went wrong n confirm
    – barlop
    Jan 11 '17 at 11:48

The hex bytes must be in the format that text2pcap expects. You can either use the Wireshark command-line text2pcap companion tool to convert the text file to a pcap file (or pcapng file via the -n option), or you can use Wireshark itself.

As barlop indicated, you might want to start with a simple packet (or small number of packets) in Wireshark and export it to a text file via Wireshark's File -> Export Packet Dissections -> as "Plain Text" file... method first in order to see the resulting output. If you do that, be sure to de-select both the "Packet summary line" and "Packet details" options and select "Packet Bytes"; otherwise you won't see the expected output.

If you want to preserve the timestamp of the packet, you'll need to export it. To do so, I would suggest creating a new Wireshark profile that only contains the absolute time column and then when performing the export, select "Packet summary line", but de-select "Include column headings". That will write the timestamp to the text file, which Wireshark or text2pcap can later use when importing it.

In Wireshark, you would import the text file using File -> Import from Hex Dump... and select the "Date/Time" checkbox if you want Wireshark to make use of any saved timestamps; the default format of "%F %T." should work just fine. Refer to the Wireshark User Guide for more information.

With text2pcap, you would use something like the following to create a pcap file from the text file, which Wireshark could open:

text2pcap -a -t "%F %T." input.txt output.pcap

Here's some sample text representing an ICMP echo request/response pair to get you going:

2017-01-12 12:30:00.000000000

0000  00 20 ee 00 00 02 00 20 ee 00 00 01 08 00 45 00   . ..... ......E.
0010  00 28 45 a7 00 00 80 01 71 78 c0 a8 01 64 c0 a8   .(E.....qx...d..
0020  01 01 08 00 a5 d0 00 01 00 3f 48 65 6c 6c 6f 20   .........?Hello 
0030  57 6f 72 6c 64 21                                 World!

2017-01-12 12:30:00.000001000

0000  00 20 ee 00 00 01 00 20 ee 00 00 02 08 00 45 00   . ..... ......E.
0010  00 28 45 a7 00 00 ff 01 f2 77 c0 a8 01 01 c0 a8   .(E......w......
0020  01 64 00 00 ad d0 00 01 00 3f 48 65 6c 6c 6f 20   .d.......?Hello 
0030  57 6f 72 6c 64 21 00 00 00 00 00 00               World!......

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.