Wireshark · Ethereal-users: Re: [Ethereal-users] Processing Text Output

[Ulf Lamping <ulf.lamping@xxxxxx>]

Steve Licking wrote:
> Hi, I have several captures of the text output of tethereal (basically 
> tethereal -V >textCaptureFile). The text is nicely formatted and has 
> been easy enough to parse so far, but I would like to convert them 
> into the libpcap format which Ethereal can read.
>
> However I have had little luck in finding a way to do this. The 
> closest I’ve found is text2pcap, however since the text captures I 
> have only give hex output for the packet data section, much of the 
> information would be lost.
>
> Are there any utilities capable of parsing the text output of Ethereal 
> and converting it into the libpcap format?
Hi!

I'm not 100% sure, but I would guess that you've lost valuable 
information so importing this into Ethereal is simply not possible.

Ethereal is good at interpreting raw bytes, but interpreting the text 
output is a very unusual way to do it (it *might* be possible in 
principle, but no one would be willing to write such an import function).

I don't know of any import way, you'll stuck with your current files, I 
fear.

You should use a "real" capture file format like libpcap for your 
further experiments.

Regards, ULFL