Wireshark-users: Re: [Wireshark-users] pcap to Text? Strip out pcap header information -> raw hex
Justin Barilar wrote:
All,
I have a few pcap captures that were captured using snoop on a Linux
machine. However, I'm looking to convert this pcap file to a raw dump of
the bytes of the packets, hence removing all the pcap header information
(global header, packet headers with timestamps).
I see there is a text2pcap function which is the opposite of what I want
to do. Is there any utility to accomplish what I want to do?
Regards,
Justin
Hi,
Sure, have a look at tshark. It can read pcap files and spit out all kinds of
details.
Thanks,
Jaap