'\" t .\" Title: text2pcap .\" Author: [see the "AUTHOR(S)" section] .\" Generator: Asciidoctor 2.0.26 .\" Date: 2026-09-03 .\" Manual: \ \& .\" Source: \ \& .\" Language: English .\" .TH "TEXT2PCAP" "1" "2026-09-03" "\ \&" "\ \&" .ie \n(.g .ds Aq \(aq .el .ds Aq ' .ss \n[.ss] 0 .nh .ad l .de URL \fI\\$2\fP <\\$1>\\$3 .. .als MTO URL .if \n[.g] \{\ . mso www.tmac . am URL . ad l . . . am MTO . ad l . . . LINKSTYLE blue R < > .\} .SH "NAME" text2pcap \- Generate a capture file from an ASCII hex dump of packets .SH "SYNOPSIS" .sp \fBtext2pcap\fP [\~\fB\-a\fP\~] [\~\fB\-b\fP\~2|8|16|64\~] [\~\fB\-D\fP\~] [\~\fB\-e\fP\~\~] [\~\fB\-E\fP\~\~] [\~\fB\-F\fP\~\~] [\~\fB\-i\fP\~\~] [\~\fB\-l\fP\~\~] [\~\fB\-N\fP\~\~] [\~\fB\-m\fP\~\~] [\~\fB\-o\fP\~hex|oct|dec|none\~] [\~\fB\-q\fP\~] [\~\fB\-r\fP\~\~] [\~\fB\-s\fP\~,,\~] [\~\fB\-S\fP\~,,\~] [\~\fB\-t\fP\~\~] [\~\fB\-T\fP\~,\~] [\~\fB\-u\fP\~,\~] [\~\fB\-4\fP\~,\~] [\~\fB\-6\fP\~,\~] [\~\fB\-\-little\-endian\fP\~] <\fIinfile\fP>|\- <\fIoutfile\fP>|\- .sp \fBtext2pcap\fP \fB\-h|\-\-help\fP .sp \fBtext2pcap\fP \fB\-v|\-\-version\fP .SH "DESCRIPTION" .sp \fBText2pcap\fP is a program that reads in an ASCII hex dump and writes the data described into a capture file. \fBtext2pcap\fP can read hex dumps with multiple packets in them, and build a capture file of multiple packets. \fBText2pcap\fP is also capable of generating dummy Ethernet, IP, and UDP, TCP or SCTP headers, in order to build fully processable packet dumps from hex dumps of application\-level data only. .sp \fBText2pcap\fP can write the file in several output formats. The \fB\-F\fP flag can be used to specify the format in which to write the capture file, \fBtext2pcap \-F\fP provides a list of the available output formats. By default, it writes the packets to \fIoutfile\fP in the \fBpcapng\fP file format. \fBText2pcap\fP also supports compression formats, which can be specified with the \fB\-\-compress\fP options. If that option is not given, the the desired compression method, if any, is deduced from the extension of \fIoutfile\fP; e.g. if it has the extension \*(Aq.gz\*(Aq, then the output file is compressed to a gzip archive. .sp \fBText2pcap\fP understands many different hex dump formats. The native format that \fBWireshark\fP displays in the Packet Bytes pane, copies to the clipboard, prints, and saves, and that \fBtshark\fP produces with the \fB\-\-hexdump\fP option is that generated by \fIod \-Ax \-tx1 \-v\fP or \fIhexdump \-X \-v\fP. That is, each line must begin with an offset describing the position in the packet, each byte is individually displayed, with spaces separating the bytes from each other, and repeated or all NUL (\*(Aq\(rs0\*(Aq) lines are not omitted. Hex digits can be upper or lowercase. \fBText2pcap\fP can handle other hex dump formats, some of which can be automatically detected and some of which require enabling options to properly recognize. .sp Offsets are followed by one or more spaces or tabs separating them from the bytes. Offsets optionally can be followed by a single colon after the digits. Offsets can be between 3 and 8 digits; hexadecimal base (radix) is assumed by default, but they can be in octal or decimal \- see \fB\-o\fP. If offsets are in hex, they can be preceded by \fI0x\fP or \fI0X\fP. Each packet must begin with offset zero, and an offset zero indicates the beginning of a new packet. Offset values must be correct; an unexpected value causes the current packet to be aborted and the next packet start awaited. There is also a single packet mode with no offsets; see \fB\-o\fP. .sp There is no limit on the width or number of bytes per line, but lines with only hex bytes without a leading offset are ignored (in other words, line breaks should not be inserted in long lines that wrap.) Bytes must be in hex; unlike with offsets (and the alternative regex mode mentioned later), other bases such as octal, decimal, or binary are unsupported. Byte groups of two to four bytes are also supported. By default byte groups are assumed to be in network (big\-endian) byte order; the \fB\-\-little\-endian\fP option can be used to support little\-endian byte order. .sp Packets may be preceded by a direction indicator (\*(AqI\*(Aq or \*(AqO\*(Aq) and/or a timestamp if indicated by the command line (see \fB\-D\fP and \fB\-t\fP). If both are present, the direction indicator precedes the timestamp. The format of the timestamps is specified as a mandatory parameter to \fB\-t\fP. If no timestamp is parsed, in the case of the first packet the current system time is used, while subsequent packets are written with timestamps one microsecond later than that of the previous packet. .sp Other text in the input data is ignored. Any text before the offset is ignored, including email forwarding characters \*(Aq>\*(Aq. Any text on a line after the bytes is ignored, e.g. an ASCII character dump (but see \fB\-a\fP to ensure that hex digits in the character dump are ignored if there is no delimiter between the hex dump and the ASCII character translation). Any line where the first non\-whitespace character is a \*(Aq#\*(Aq will be ignored as a comment. Some hex dump utilities use a line containing a single \*(Aq*\*(Aq to indicate omitted lines, either duplicating the previous line or entirely consisting of NUL (\*(Aq\(rs0\*(Aq) bytes; this is not supported. Any lines of text between the bytestring lines are considered preamble; the beginning of the preamble is scanned for the direction indicator and timestamp as mentioned above and otherwise ignored. .sp Any line beginning with #TEXT2PCAP is a directive and options can be inserted after this command to be processed by \fBtext2pcap\fP. Currently there are no directives implemented; in the future, these may be used to give more fine grained control on the dump and the way it should be processed e.g. timestamps, encapsulation type etc. .sp In general, short of these restrictions, \fBtext2pcap\fP is pretty liberal about reading in hex dumps and has been tested with a variety of mangled outputs (including being forwarded through email multiple times, with limited line wrap etc.) .sp Here is a sample dump that \fBtext2pcap\fP can recognize, with optional directional indicator and timestamp: .sp .if n .RS 4 .nf .fam C I 2019\-05\-14T19:04:57Z 000000 00 0e b6 00 00 02 00 0e b6 00 00 01 08 00 45 00 000010 00 28 00 00 00 00 ff 01 37 d1 c0 00 02 01 c0 00 000020 02 02 08 00 a6 2f 00 01 00 01 48 65 6c 6c 6f 20 000030 57 6f 72 6c 64 21 000036 .fam .fi .if n .RE .sp \fBText2pcap\fP is also capable of scanning a text input file using a custom Perl compatible regular expression that matches a single packet. \fBtext2pcap\fP searches the given file (which must end with \*(Aq\(rsn\*(Aq) for non\-overlapping non\-empty strings matching the regex. Named capturing subgroups, which must match exactly once per packet, are used to identify fields to import. The following fields are supported in regex mode, one mandatory and three optional: .sp .if n .RS 4 .nf .fam C "data"\& Actual captured frame data to import "time"\& Timestamp of packet "dir"\& Direction of packet "seqno" Arbitrary ID of packet .fam .fi .if n .RE .sp The \*(Aqdata\*(Aq field is the captured data, which must be in a selected encoding: hexadecimal (the default), octal, binary, or base64 and containing no characters in the data field outside the encoding set besides whitespace. The \*(Aqtime\*(Aq field is parsed according to the format in the \fB\-t\fP parameter. The first character of the \*(Aqdir\*(Aq field is compared against a set of characters corresponding to inbound and outbound that default to "iI<" for inbound and "oO>" for outbound to assign a direction. The \*(Aqseqno\*(Aq field is assumed to be a positive integer base 10 used for an arbitrary ID. An optional field\(cqs information will only be written if the field is present in the regex and if the capture file format supports it. (E.g., the pcapng format supports all three fields, but the pcap format only supports timestamps.) .sp Here is a sample dump that the regex mode can process with the regex \*(Aq^(?[<>])\(rss(?