# -*- Python -*- import re import sys import string if len(sys.argv) > 1: f = open (sys.argv[1]) else: f = sys.stdin timestamp = None hex_data = [] ascii_data = [] # 66.207.14.225 # capture: # tcpdump -s 1500 -w /tmp/capture.bin -i lo0 port 5555 # dump as hex: # tcpdump -r /tmp/capture.bin -X # [changed to support a new? tcpdump output format Apr 2005] def un_hex (s): l = [] for i in range(len(s)/2): x = 2 * i n = string.atoi (s[x:x+2], 16) l.append (chr(n)) return ''.join (l) data_bytes = 0 while 1: line = f.readline() if not line: break else: if line[2] == ':': # how many bytes to come? # 14:37:06.876108 10.1.1.70.5555 > 10.1.1.70.1239: P 6:18(12) ack 18 win 57920 (DF) # re.search (, part) # start a new line # 1) print old line if hex_data and data_bytes: if data_bytes: print timestamp hex_data = ''.join (hex_data).strip() un_hex_data = un_hex (hex_data)[-data_bytes:] print repr(un_hex_data) timestamp = line m = re.search ('\([0-9]+\)', line.split()[6]) if m: data_bytes = int (m.group(0)[1:-1]) else: data_bytes = 0 hex_data = [] ascii_data = [] elif line[:3] == '\t0x': for j in range (8): p = 10 + (j*5) hex_data.append (line[p:p+4]) ascii_data.append (line[57:-1]) else: print 'huh?'