Looking for Windows-based software for opening a WireShark .dump file w/o WireShark

Question

Apparently there is a way in Ubuntu, but I'm on a Windows box. XP, to be specific. I want to import this data into Access, but can't figure out how to even open the file and Access won't recognize the extension.

Does anyone know how to open one of these files, or convert it to something Access understands?

Here's the Ubuntu link:

https://stackoverflow.com/questions/21594860/how-do-i-open-a-dump-file-format-in-ubuntu-without-using-wireshark

Answer 1

You could use scapy which will read a pcap file and will even write them, (it will also allow you to capture traffic without wireshark and generate traffic which wireshark will not do).

Example of reading from the demo:

>>> a=rdpcap("/spare/captures/isakmp.cap")
>>> a
<isakmp.cap: UDP:721 TCP:0 ICMP:0 Other:0>
>>> a[423].pdfdump(layer_shift=1)
>>> a[423].psdump("/tmp/isakmp_pkt.eps",layer_shift=1)

Answer 2

I believe Wireshark dump files are pcap files.

A couple of options:

• Open them using tcpdump which produces text output, which you could parse in Access code.
• Read them using a library such as pcap.net, which I think you can use from Access.

Answer 3

VEdit will open files with a .dump extension. Turns out the files in question are simple ASCII and look like MySQL code to recreate tables of data, complete with table layouts and insert statements. I'll have to see whether or not I can import them into MySQL or if they need to be converted first.