0

I can write a program which does it, but actually, is there a way to do it in one liner from cli? I don't care about the time it takes, I prefer to have some standard solution instead of developing and to maintain my code. By data I mean everything after the transport header, without exceeding the packet boundaries.

e271p314
  • 3,841
  • 7
  • 36
  • 61
  • You do know that you can not only capture data but also read pcap files with tcpdump and tshark? If these are not enough that you should better detail what kind of output you exactly expect. – Steffen Ullrich Apr 29 '15 at 19:14
  • If I have a pcap file with 100 packets, and each packet has data of size n I expect the output to be in size 100n, that is, all the data buffers one after the other without all the ethernet, ip and transport headers, just the data. – e271p314 Apr 29 '15 at 19:25

1 Answers1

0

Take a look here

I used this this

tcpick -yR -r file.pcap
Community
  • 1
  • 1
e271p314
  • 3,841
  • 7
  • 36
  • 61