diff --git a/doc/text2pcap.adoc b/doc/text2pcap.adoc index 1423c4a545..0075fa565b 100644 --- a/doc/text2pcap.adoc +++ b/doc/text2pcap.adoc @@ -14,6 +14,7 @@ text2pcap - Generate a capture file from an ASCII hexdump of packets [manarg] *text2pcap* [ *-a* ] +[ *-b* 2|8|16|64 ] [ *-D* ] [ *-e* ] [ *-h* ] @@ -24,6 +25,7 @@ text2pcap - Generate a capture file from an ASCII hexdump of packets [ *-m* ] [ *-o* hex|oct|dec|none ] [ *-q* ] +[ *-r* ] [ *-s* ,, ] [ *-S* ,, ] [ *-t* ] @@ -97,12 +99,57 @@ future, these may be used to give more fine grained control on the dump and the way it should be processed e.g. timestamps, encapsulation type etc. +*Text2pcap* is also capable of scanning a text input file using a custom Perl +compatible regular expression that matches a single packet. *text2pcap* +searches the given file (which must end with '\n') for non-overlapping non-empty +strings matching the regex. Named capturing subgroups, which must match +exactly once per packet, are used to identify fields to import. The following +fields are supported in regex mode, one mandatory and three optional: + + "data" Actual captured frame data to import + "time" Timestamp of packet + "dir" Direction of packet + "seqno" Arbitrary ID of packet + +The 'data' field is the captured data, which must be in a selected encoding: +hexadecimal (the default), octal, binary, or base64 and containing no +characters in the data field outside the encoding set besides whitespace. +The 'time' field is parsed according to the format in the *-t* parameter. +The first character of the 'dir' field is compared against a set of characters +corresponding to inbound and outbound that default to "iI<" for inbound and +"oO>" for outbound to assign a direction. The 'seqno' field is assumed to +be a positive integer base 10 used for an arbitrary ID. An optional field's +information will only be written if the field is present in the regex and if +the capture file format supports it. (E.g., the pcapng format supports all +three fields, but the pcap format only supports timestamps.) + +Here is a sample dump that the regex mode can process with the regex +'^(?[<>])\s(?