importing hex stream into wireshark

wireshark hexdump
tcpip picture tcpip · May 17, 2014 · Viewed 7.9k times · Source

I have a 64 byte hex stream of a frame-

000A959D6816000A959A651508004500002E000000004006AF160A010101C0A8000A11D71EC6000000000000000050000000AD840000000102030405CC904CE3

How can I import it into Wireshark and see the whole packet? The option of importing hex dump doesn't seems to work in my case, if I save this stream into a text file and load it.

Answer

tcpip picture tcpip · May 17, 2014

Since this hex stream is in hex, and for hex to hexdump conversion, od doesn't seems to work. So the solution would be to convert this hex back to binary, and then use od -Ax -tx1 -v [file] on that binary file.

xxd -r -p [hexfile] [binaryfile]
od -Ax -tx1 -v [binaryfile]

Note: Use the combination -r -p to read plain hexadecimal dumps without line number information and without a particular column layout.

Related questions

How to filter by IP address in Wireshark?

I tried dst==192.168.1.101 but only get : Neither "dst" nor "192.168.1.101" are field or protocol names. The following display filter isn't a valid display filter: dst==192.168.1.101

Read More
Capturing mobile phone traffic on Wireshark

How can I capture mobile phone traffic on Wireshark?

Read More
Wireshark localhost traffic capture

I wrote a simple server app in C which runs on localhost. How to capture localhost traffic using Wireshark?

Read More