1

I'm trying to merge multiple plain text packets into one large pcap file. I have been using text2pcap on each individual text file, then using mergecap on all the pcaps to create my final output. However, that's really slow, as it involves writing out that each pcap file, merging them all together, and then deleting all the single pcaps. I'm looking to speed that up by sending multiple text files into text2pcap at once.

Unfortunately, from what I understand, text2pcap requires the ofsets on the text file to be correct, and since I'm merging multiple different packets, I'm starting over at 0000 multiple times, and I think that's causing my errors.

So, assuming I have a packet that looks like this:

0000 30 00 20
0010 59 23 00

and another packet that looks like this:

0000 23 50 2c
0010 a4 23 f1

How would I best convert the two of them into a single pcap file?

lightstrike
  • 954
  • 2
  • 15
  • 31

1 Answers1

0

You can also use PDD - Packet Dump Decode.
You can find an example in my article at LoveMyTool.