Wireshark-dev: Re: [Wireshark-dev] Change amount of bytes per line with tshark -x
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 7 Aug 2017 11:17:52 -0700
On Aug 7, 2017, at 7:16 AM, Remy Leone <remy.leone@xxxxxxxx> wrote:

> tshark -x is very useful to get packets dumps like this one:
> 
> 
>            000000 00 0e b6 00 00 02 00 0e b6 00 00 01 08 00 45 00
>            000010 00 28 00 00 00 00 ff 01 37 d1 c0 00 02 01 c0 00
>            000020 02 02 08 00 a6 2f 00 01 00 01 48 65 6c 6c 6f 20
>            000030 57 6f 72 6c 64 21
>            000036
> 
> I was wondering if it is possible to instruct tshark to have a complete hexdump of a packet on a single line.

No, it's not.  The main purpose of the dump is human readability; a one-line dump is unlikely to be very human-readable, so that format would presumably be primarily intended for machine-readability.