Ethereal-users: Re: [Ethereal-users] Processing Text Output

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Wed, 01 Feb 2006 00:02:56 +0100
Steve Licking wrote:

Hi, I have several captures of the text output of tethereal (basically tethereal -V >textCaptureFile). The text is nicely formatted and has been easy enough to parse so far, but I would like to convert them into the libpcap format which Ethereal can read.

However I have had little luck in finding a way to do this. The closest I�ve found is text2pcap, however since the text captures I have only give hex output for the packet data section, much of the information would be lost.

Are there any utilities capable of parsing the text output of Ethereal and converting it into the libpcap format?

Hi!

I'm not 100% sure, but I would guess that you've lost valuable information so importing this into Ethereal is simply not possible.

Ethereal is good at interpreting raw bytes, but interpreting the text output is a very unusual way to do it (it *might* be possible in principle, but no one would be willing to write such an import function).

I don't know of any import way, you'll stuck with your current files, I fear.

You should use a "real" capture file format like libpcap for your further experiments.

Regards, ULFL