Ethereal-users: Re: [Ethereal-users] Analyze the Hex dump file

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 22 May 2004 00:58:02 -0700
On Fri, May 21, 2004 at 02:05:44PM -0400, GUOMING WEI wrote:
> Is it possible to use ethereal to analyze a hex dump file? It seems that
> ethereal doesn't like the format.

Correct - it has no idea what to do with a hex dump; for one thing, it
doesn't even know what link-layer types the packets have.

> For instance, format as following.
> 02E3B8C6  01 00 5E 00 00 05 FF FF  FF FF FF FF 08 00 45 00  ..^...........E.
> 02E3B8D6  00 40 FF 00 00 00 01 59  C3 5E 17 00 00 01 E0 00  [email protected].^......
> 02E3B8E6  00 05 02 01 00 2C 17 00  00 01 00 00 00 00 8D 9D  .....,..........
> 02E3B8F6  00 00 00 00 00 00 00 00  00 00 FF FF FF FF 00 0A  ................
> 02E3B906  42 01 00 00 00 28 17 00  00 01 00 00 00 00 18 00  B....(..........
> 02E3B916  00 01 00 00 00 00 00 00  00 00 00 01 00 00 00 76  ...............v
> 02E3B926  00 00 00 00 00 00 00 00  4F 4D 45 2D 30 30 36 30  ........OME-0060
> 02E3B936  33 38 31 35 43 37 30 46  00 00 00 00 00 00 00 00  3815C70F........
> 02E3B946  00 00 00 00 00 0A 00 00  00 01 00 00 00 01 5A 5A  ..............ZZ
> 02E3B956  5A 5A 5A 5A 00 00 06 01  00 00 00 00 01 1E BB C0  ZZZZ............
> 02E3B966  33 00 21 30 1F 00 00 00  00 00 41 75 00 70 00 67  3.!0......Au.p.g
> 02E3B976  00 62 00 6B 00 0F 00 3A  75 00 70 00 00 00 FF FF  .b.k...:u.p.....
> 02E3B986  FF FF FF FF 00 00 FF FF  FF FF 55 50 47 42 4B 55  ..........UPGBKU
> 02E3B996  50 20 20 20 20 10 00 24  33 00 21 30 21 30 00 00  P    ..$3.!0!0..
> 02E3B9A6  33 00 21 30 20 00 00 00  00 00 41 67 00 6D 00 64  3.!0 .....Ag.m.d
> 02E3B9B6  00 70 00 72 00 0F 00 28  6F 00 76 00 2E 00 30 00  .p.r...(o.v...0.

Is that just a stream of packet data, rather than a sequence of hex
dumps of packets?  If not, then the text2pcap utility that comes with
Ethereal might be able to convert it to a capture file that Ethereal can
read; if so, you'll have to break it up into packets and then try
converting it.