Offset of zero is indicative of starting a new packet, so a single text file with a series of hexdumps can be converted into a packet capture with multiple Any hex numbers in this text are also ignored. Any text after the bytes is ignored (e.g. An offset is recognized asīeing a hex number longer than two characters. Any line which has only bytes without a leading offset is ignored. Offsets are used to track the bytes, so offsets must be correct. Any lines of text between the bytestring lines is ignored. Any text before the offset is ignored, including email forwarding characters '>'. Also the text dump at the end of the line is ignored. There is no limit on the width or number of bytes per line. Here is a sample dump that text2pcap can recognize:Ġ00030 01 01 0f 19 03 80 11 01. The offset is a hex number (can also be octal or decimal - see -o), Each line begins with an offset describing the position in the file. In other words, each byte is individually displayed and surrounded Text2pcap understands a hexdump of the form generated by od -Ax -tx1 -v. text2pcap is also capable of generatingĭummy Ethernet, IP and UDP, TCP, or SCTP headers, in order to build fully processable packetĭumps from hexdumps of application-level data only. Text2pcap can read hexdumps with multiple packets in them, and build a capture file of multiple packets. Text2pcap is a program that reads in an ASCII hex dump and writes the data described into a libpcap capture file.