1

I'm looking for a Windows or Linux program that can filter text strings out of the user data fields of a Wireshark capture file.

I am writing a program to communicate with an embedded computer using an undocumented TCP/IP link. I can capture messages being sent in each direction by existing equipment and I can see they are purely ASCII text. But its hard to see the exchanges at a glance within the default Wireshark view where I have to scroll through the messages one at a time to see the user data. I need to see just the text of the messages.

Essential features

  • Free
  • Runs under Windows 10 or Ubuntu
  • Opens a Wireshark .pcapng file
  • For TCP packets with any ASCII user data writes out the ascii data
  • Ignores packets with no ascii user data

Nice to have features

  • Wireshark like filters for IP addresses
  • There can be multiple messages separated by CR or LF or both in a single packet, an output of one message per line preceded by the originator's IP address would be great
  • What are you looking for that “Follow TCP stream” doesn't do? – Gilles 'SO- stop being evil' Sep 3 '15 at 19:48
  • Nothing -its perfect! - I didn't know it existed, Thanks – user977870 Sep 10 '15 at 13:29
1

You do not actually need another piece of software to do this. You can use wiresharks built in find packet tool. To do this go to edit and then click on find packet.

enter image description here

in the filter section type in the string that you want to search for. In the by part you need to select string to search for a string. You will probably want to leave case sensitive unchecked unless you want to search for a case sensitive string. the direction just changes which way it will search. So if you have the top packet selected and you go down it will find the first packet with that string down from the original packet you had selected. Then press find and it will find a packet. To find the next packet click find again.

  • Thanks for the suggestion Aiden, but I don't have a problem finding the packets. I really need to end up with a text file with a list of the packets. There's a lot of asynchronous interactions and manually viewing the packets one at a time is a struggle. I've currently resorted to highlighting the user data field and copying bytes->Printable text only then pasting into a file one by one. Its pretty laborious... – user977870 Aug 4 '15 at 8:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.