include::../docbook/attributes.adoc[] = text2pcap(1) :doctype: manpage :stylesheet: ws.css :linkcss: :copycss: ../docbook/{stylesheet} == NAME text2pcap - Generate a capture file from an ASCII hexdump of packets == SYNOPSIS [manarg] *text2pcap* [ *-a* ] [ *-b* 2|8|16|64 ] [ *-D* ] [ *-e* ] [ *-E* ] [ *-F* ] [ *-h* ] [ *-i* ] [ *-l* ] [ *-n* ] [ *-N* ] [ *-m* ] [ *-o* hex|oct|dec|none ] [ *-q* ] [ *-r* ] [ *-s* ,, ] [ *-S* ,, ] [ *-t* ] [ *-T* , ] [ *-u* , ] [ *-v* ] [ *-4* , ] [ *-6* , ] <__infile__>|- <__outfile__>|- == DESCRIPTION *Text2pcap* is a program that reads in an ASCII hex dump and writes the data described into a capture file. *text2pcap* can read hexdumps with multiple packets in them, and build a capture file of multiple packets. *Text2pcap* is also capable of generating dummy Ethernet, IP and UDP, TCP, or SCTP headers, in order to build fully processable packet dumps from hexdumps of application-level data only. *Text2pcap* can write the file in several output formats. The *-F* flag can be used to specify the format in which to write the capture file, *text2pcap -F* provides a list of the available output formats. By default, it writes the packets to __outfile__ in the *pcap* file format. *Text2pcap* understands a hexdump of the form generated by __od -Ax -tx1 -v__. In other words, each byte is individually displayed, with spaces separating the bytes from each other. Each line begins with an offset describing the position in the packet, each new packet starts with an offset of 0 and there is a space separating the offset from the following bytes. The offset is a hex number (can also be octal or decimal - see *-o*), of more than two hex digits. Here is a sample dump that *text2pcap* can recognize: 000000 00 0e b6 00 00 02 00 0e b6 00 00 01 08 00 45 00 000010 00 28 00 00 00 00 ff 01 37 d1 c0 00 02 01 c0 00 000020 02 02 08 00 a6 2f 00 01 00 01 48 65 6c 6c 6f 20 000030 57 6f 72 6c 64 21 000036 Note the last byte must either be followed by the expected next offset value as in the example above or a space or a line-end character(s). There is no limit on the width or number of bytes per line. Also the text dump at the end of the line is ignored. Bytes/hex numbers can be uppercase or lowercase. Any text before the offset is ignored, including email forwarding characters '>'. Any lines of text between the bytestring lines is ignored. The offsets are used to track the bytes, so offsets must be correct. Any line which has only bytes without a leading offset is ignored. An offset is recognized as being a hex number longer than two characters. Any text after the bytes is ignored (e.g. the character dump). Any hex numbers in this text are also ignored. An offset of zero is indicative of starting a new packet, so a single text file with a series of hexdumps can be converted into a packet capture with multiple packets. Packets may be preceded by a direction indicator and a timestamp if indicated by the command line (see *-D* and *-t*). The format of the timestamps is specified as a mandatory parameter to *-t*. If timestamp parsing is not enabled or failed, the first packet is timestamped with the current time the conversion takes place. Multiple packets are written with timestamps differing by one microsecond each. In general, short of these restrictions, *text2pcap* is pretty liberal about reading in hexdumps and has been tested with a variety of mangled outputs (including being forwarded through email multiple times, with limited line wrap etc.) There are a couple of other special features to note. Any line where the first non-whitespace character is '#' will be ignored as a comment. Any line beginning with #TEXT2PCAP is a directive and options can be inserted after this command to be processed by *text2pcap*. Currently there are no directives implemented; in the future, these may be used to give more fine grained control on the dump and the way it should be processed e.g. timestamps, encapsulation type etc. *Text2pcap* is also capable of scanning a text input file using a custom Perl compatible regular expression that matches a single packet. *text2pcap* searches the given file (which must end with '\n') for non-overlapping non-empty strings matching the regex. Named capturing subgroups, which must match exactly once per packet, are used to identify fields to import. The following fields are supported in regex mode, one mandatory and three optional: "data" Actual captured frame data to import "time" Timestamp of packet "dir" Direction of packet "seqno" Arbitrary ID of packet The 'data' field is the captured data, which must be in a selected encoding: hexadecimal (the default), octal, binary, or base64 and containing no characters in the data field outside the encoding set besides whitespace. The 'time' field is parsed according to the format in the *-t* parameter. The first character of the 'dir' field is compared against a set of characters corresponding to inbound and outbound that default to "iI<" for inbound and "oO>" for outbound to assign a direction. The 'seqno' field is assumed to be a positive integer base 10 used for an arbitrary ID. An optional field's information will only be written if the field is present in the regex and if the capture file format supports it. (E.g., the pcapng format supports all three fields, but the pcap format only supports timestamps.) Here is a sample dump that the regex mode can process with the regex '^(?[<>])\s(?