Wireshark-dev: Re: [Wireshark-dev] Displaying hex dump ONLY in tshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Mon, 22 Aug 2011 18:35:38 -0400
On 8/22/2011 6:06 PM, kahou lei wrote:

0000  00 10 94 00 00 02 00 10 94 00 00 01 08 00 45 00   ..............E.
0010  00 6e 00 2c 00 00 ff 06 3a 05 c0 55 01 02 c0 00   .n.,....:..U....
0020  00 01 04 00 04 00 00 01 e2 40 00 03 94 47 50 10   .........@...GP.
0030  10 00 35 e5 00 00 00 00 00 00 00 00 00 00 00 00   ..5.............
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0060  00 00 00 00 00 00 00 00 d3 f7 31 d9 08 e3 6c 13   ..........1...l.
0070  ab 44 7e bd 30 4b 44 fd f6 c1 58 f0 ee d0 6f 8d   .D~.0KD...X...o.

I don't want the index number and the display out on the right most area. Is
there a way I can only display the hex values in between?


tshark won't do that.
One way: Doing a little creative scripting with grep/sed/awk (if you're running on *nix or using cygwin on Windows or have other access to *nix tools).