4

Recently there was a requirement for me to convert the textual output of "tcpdump -i eth0 -neXXs0" into a pcap file. So I wrote a python script which converts the information into an intermediate format understandable by text2pcap. Since this is my first program in python there would obviously be scope for improvement. I want knowledgeable folks to weed out any descrepancy and/or enhance it.

Input

The tcpdump output is in the following format:

20:11:32.001190 00:16:76:7f:2b:b1 > 00:11:5c:78:ca:c0, ethertype IPv4 (0x0800), length 72: 123.236.188.140.41756 > 94.59.34.210.45931: UDP, length 30

0x0000:  0011 5c78 cac0 0016 767f 2bb1 0800 4500  ..\x....v.+...E.
0x0010:  003a 0000 4000 4011 812d 7bec bc8c 5e3b  .:..@.@..-{...^;
0x0020:  22d2 a31c b36b 0026 b9bd 2033 6890 ad33  "....k.&...3h..3
0x0030:  e845 4b8d 2ba1 0685 0cb3 70dd 9b98 76d8  .EK.+.....p...v.
0x0040:  8fc6 8293 bf33 325a                      .....32Z

Output

enter code here

Format understandable by text2pcap:

20:11:32.001190

0000: 00 11 5c 78 ca c0 00 16 76 7f 2b b1 08 00 45 00   ..\x....v.+...E. 
0010: 00 3a 00 00 40 00 40 11 81 2d 7b ec bc 8c 5e 3b   .:..@.@..-{...^; 
0020: 22 d2 a3 1c b3 6b 00 26 b9 bd 20 33 68 90 ad 33   "....k.&...3h..3
0030: e8 45 4b 8d 2b a1 06 85 0c b3 70 dd 9b 98 76 d8   .EK.+.....p...v. 
0040: 8f c6 82 93 bf 33 32 5a   .....32Z 

Following is my Code.

import re
# Identify time of the current packet.
time = re.compile ('(..:..:..\.[\w]*) ')
# Get individual elements from the packet. ie. offset, hexdump, chars
all = re.compile('[ |\t]+0x([\w]+:) +(.+)  +(.*)')
# Regex for two spaces
twoSpaces = re.compile('  +')
# Regex for single space
singleSpace = re.compile(' ')
# Single byte pattern.
singleBytePattern = re.compile(r'([\w][\w])')

# Open files.
f = open ('pcap.txt', 'r')
outfile = open ('ashu.txt', 'w')

for line in f:
  result = time.match (line)
  if result:
    # If current line contains time format dump only time
    print result.group()
    outfile.write (result.group() + '\n')
  else:
    print line,
    # Split line containing hex dump and tokenize into list elements.
    result = all.split (line)
    if result:
      i = 0
      for values in result:
        if (i == 2):
          # Strip off additional spaces in hex dump
          # Useful when hex dump does not end in 16 bytes boundary.
          val = twoSpaces.sub ('', values)

          # Tokenize individual elements seperated by single space.
          byteResult = singleSpace.split (val)
          for twoByte in byteResult:
            # Identify individual byte
            singleByte = singleBytePattern.split(twoByte)
            byteOffset = 0
            for oneByte in singleByte:
              if ((byteOffset == 1) or (byteOffset == 3)):
               # Write out individual byte with a space char appended
               print oneByte, 
               outfile.write (oneByte+ ' ')
              byteOffset = byteOffset + 1
        elif (i == 3):
          # Write of char format of hex dump
          print "  "+values,
          outfile.write ('  ' + values+ ' ')
        elif (i == 4):
          outfile.write (values) 
        else:
          print values,
          outfile.write (values + ' ')
        i=i+1
    else:
      print "could not split"
f.close ()
outfile.close ()
1
  • 1
    For starters, you should indent your comments to the same level as the code they refer to. It is very distracting to see the indentation broken up the way it currently is. Oct 10, 2010 at 13:15

2 Answers 2

3

Use the -w option of tcpdump to write to a pcap format file

tcpdump -w filename.pcap

Wireshark should be able to read it.

3
  • The requirement is that I just have the hexdump in a *.txt file format. This *.txt file needs to be converted into a *.pcap format so that I can replay it with 'tcpreplay' command.
    – Taroko
    Oct 11, 2010 at 4:01
  • Since no one has responded should I assume that my code is perfect.
    – Taroko
    Oct 15, 2010 at 7:55
  • There is no perfect code :-) only individual choices on how to code a for purpose. With Python, I am certain there will be a dozen variations possible -- some very short too.
    – nik
    Oct 15, 2010 at 8:14
0

I made a powershell equivalent. text2pcap.exe accepts it but I do get mostly "Inconsistent offset. Expecting 0, got 10. Ignoring rest of packet" warnings. Wireshark opens but doesn't look right. I'm going to check my tcpdump operands and text2pcap operands to see if I can get it to look better.

Providing code below in case it helps someone.

$text.split(10)|forEach{ if($_ -notmatch"0x"){$_} else { $num = [regex]::match($_,"(?<=0x)\d.*:").value ; $hex = [regex]::matches($_," \w.+").value.trim().replace(" ","") |%{$_ -split ("([a-z0-9]{2})")}; [string]$num,[string]$hex -join " "} }

2023-03-20 13:20:04.309607 IP 192.168.0.2.443 > 192.168.0.10.56321: Flags [.], ack 11801, win 498, length 0
0000:  45  00  00  28  3d  e9  40  00  ff  06  00  00  c0  a8  0c  57 E..(=.@........W
0010:  0a  fc  16  ba  01  bb  dc  01  38  29  25  31  51  97  cd  b6 ........8)% 1Q ...
0020:  50  10  01  f2  00  00  00  00 P.......

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.