I'm looking for a Windows or Linux program that can filter text strings out of the user data fields of a Wireshark capture file.
I am writing a program to communicate with an embedded computer using an undocumented TCP/IP link. I can capture messages being sent in each direction by existing equipment and I can see they are purely ASCII text. But its hard to see the exchanges at a glance within the default Wireshark view where I have to scroll through the messages one at a time to see the user data. I need to see just the text of the messages.
- Runs under Windows 10 or Ubuntu
- Opens a Wireshark .pcapng file
- For TCP packets with any ASCII user data writes out the ascii data
- Ignores packets with no ascii user data
Nice to have features
- Wireshark like filters for IP addresses
- There can be multiple messages separated by CR or LF or both in a single packet, an output of one message per line preceded by the originator's IP address would be great