Wireshark · Wireshark-dev: Re: [Wireshark-dev] Small query

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Krishnamurthy Mayya wrote:
> Hi all,
>
>  I have been facing problems with creating a packet in Centos 6.2. I 
> have a hex file which i am using as input to *text2pcap. *But, the 
> output will always say 0 packets read, 0 packtes wrote.
> Has anyone encountered the similar problem in Centos 6.2. How to 
> overcome this problem??
> Thanks in advance.

text2pcap is very particular about the format it is given.  Common 
mistakes (that I make anyway):

- Are the line(s) prefixed with an offset of 000?  E.g.:
000 ab cd ef [...]

- Is there a space at the end of the line(s)--at least after the hex 
dump stops?  This may have been fixed, but I don't remember in what 
version(s).

Another thing to try is to use the 'od' command line options recommended 
in the man page on some random file to verify that text2pcap is really 
working, then try to manually apply that random file's 'od' output 
format to your file.