hexadecimal string to wireshark pcap

linux, wireshark

Solution

You can use the following script. This is just a workaround. `od` and `hexdump` will interpret `0` as the character `'0'`, and use the byte `48`, so you may not get proper output. The script reads two chars for 16 times, and offset is incremented accordingly. Pretty simple to understand I guess:)

#!/bin/bash
off=0
while [ 1 ]
do
        printf "%04x " $off
        for ((i=0;i<16;i++))
        do
                read -n 2 a
                [ $? -ne 0 ] && echo && exit
                echo -n "$a "
        done
        echo
        off=`expr $off + 16`
done <test

where `test` is the file that holds the stream. I got the following output for your input.

0000 00 00 00 00 00 AA 00 00 00 00 00 01 88 47 00 3E
0010 80 0A 00 00 D1 0A 10 00 89 02 20 01 05 46 00 00
0020 00 01 00 02 04 03 6D 64 31 02 03 6D 61 57 00 00
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0060 00 00 00 00 00

Problem

Original source