On Aug 22, 2011, at 3:06 PM, kahou lei wrote: > Hi, > > Is there a way to display hex dump ONLY in tshark? Currently if I use -x > option, it will display something like this: > > 0000 00 10 94 00 00 02 00 10 94 00 00 01 08 00 45 00 ..............E. > 0010 00 6e 00 2c 00 00 ff 06 3a 05 c0 55 01 02 c0 00 .n.,....:..U.... > 0020 00 01 04 00 04 00 00 01 e2 40 00 03 94 47 50 10 .........@...GP. > 0030 10 00 35 e5 00 00 00 00 00 00 00 00 00 00 00 00 ..5............. > 0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 0060 00 00 00 00 00 00 00 00 d3 f7 31 d9 08 e3 6c 13 ..........1...l. > 0070 ab 44 7e bd 30 4b 44 fd f6 c1 58 f0 ee d0 6f 8d .D~.0KD...X...o. > > I don't want the index number and the display out on the right most area. Is > there a way I can only display the hex values in between?
There's no option to do that. You could look at piping to a script. Do you want anything *other* than the hex dump? If not, then if you're doing a live capture or reading a pcap (or, with newer versions of libpcap, pcap-ng) file, you could write a program (which could be written in one of the scripting languages that supports libpcap) that reads the capture and just dumps out the raw packet data in hex. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
