Pcap捕获合并问题

发布于 2024-11-15 20:43:44 字数 921 浏览 5 评论 0原文

我有两个 pcap 文件

$ capinfos cap1_stego0.pcap 
File name:           cap1_stego0.pcap
File type:           Wireshark/tcpdump/... - libpcap
File encapsulation:  Raw IP
Number of packets:   713

，

$ capinfos cap1_wlan0.pcap 
File name:           cap1_wlan0.pcap
File type:           Wireshark/tcpdump/... - libpcap
File encapsulation:  Ethernet

我想合并它们，但封装不同。如果我使用

mergecap -v -w asd.pcap cap1_stego0.pcap cap1_wlan0.pcap -T rawip

或

mergecap -v -w asd.pcap cap1_wlan0.pcap cap1_stego0.pcap -T rawip

Wireshark 无法识别过去的第二个文件，并将 cap1_wlan0.pcap 数据包或 cap1_stego0.pcap 数据包显示为 原始数据包数据 分别。还使用“tcpslice”删除 cap1_wlan0.pcap 的以太网层（使两个文件都具有 rawip 封装），显示无法识别的数据包数据。

我该怎么办？有没有办法将 pcap 与不同封装合并或转换 eth->rawip 或 rawip->eth？谢谢。

原文

I have two pcap files

$ capinfos cap1_stego0.pcap 
File name:           cap1_stego0.pcap
File type:           Wireshark/tcpdump/... - libpcap
File encapsulation:  Raw IP
Number of packets:   713

and

$ capinfos cap1_wlan0.pcap 
File name:           cap1_wlan0.pcap
File type:           Wireshark/tcpdump/... - libpcap
File encapsulation:  Ethernet

I want to merge them, but the incapsulation is different. If i use

mergecap -v -w asd.pcap cap1_stego0.pcap cap1_wlan0.pcap -T rawip

mergecap -v -w asd.pcap cap1_wlan0.pcap cap1_stego0.pcap -T rawip

Wireshark doesn't recognize the second past file and shows packets of cap1_wlan0.pcap or packets of cap1_stego0.pcap as raw packet data respectively. Also using "tcpslice" to remove ethernet layer of cap1_wlan0.pcap (to have both file with rawip encapsulation) show me unrecognized packet data.

How can i do? there is a way to merge pcap with different encapsulation or to convert eth->rawip or rawip->eth? Thank you.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

温馨耳语 2024-11-22 20:43:44

将 RAW_IP 文件转换为以太网封装文件（然后可以与其他以太网封装文件合并）的一种方法：

使用 tshark 从 RAW_IP 文件获取数据包的十六进制转储：
```
tshark -nxr pcap 文件名 | grep -vP "^ +\d" > > foo.txt
```
（ grep 用于从 tshark 输出中删除“摘要”行）。
使用text2pcap转换回pcap文件，同时添加虚拟文件
以太网标头：
```
text2pacp -e 0x0800 foo.txt foo.pcap
```

如果您想保留时间戳，则必须使用 tshark 输出进行一些操作
获取一个文本文件，其中包含 text2pcap 可接受的格式的时间戳，并且还包含十六进制数据包信息。

[[
tcpslice 是否可以选择删除以太网标头？
（查看手册页，似乎 tcpslice 用于从 pcap 文件中提取时间范围）。

如果您确实有办法从捕获文件中删除以太网标头，则必须确保生成的 pcap 文件的封装类型为 RAW_IP，然后再尝试使用wireshark、mergecap 等读取它。

另请注意，mergecap 的 -T 开关仅强制文件中指定的封装类型；实际的封装没有改变（即没有添加/更改/删除字节）。
]]

One way to convert a RAW_IP file to an ethernet encapsulated file (which can then be merged with other ethernet-encapsulated files):

Use tshark to get a hex dump of the packets from the RAW_IP file:
```
tshark -nxr pcap-file-name | grep -vP "^ +\d" > foo.txt
```
( grep is used to remove the "summary" lines from the tshark output).
Use text2pcap to convert back to a pcap file while adding dummy
ethernet headers:
```
text2pacp -e 0x0800 foo.txt foo.pcap
```

If you want to keep the timestamps, you'll have to play around a bit with the tshark output
to get a text file which contains the timestamps in a format which text2pcap will accept and also contains the hex packet info.

[[
Does tcpslice have an option to remove ethernet headers ?
(Looking at the man page, it appears that tcpslice is used to extract time-ranges from a pcap file).

If you do have a way to remove ethernet headers from a capture file, you must make sure the resulting pcap file has an encapsulation type of RAW_IP before trying to read it with wireshark, mergecap , etc).

Also note that the -T switch to mergecap just forces the encapsulation type specified in the file; The actual encapsulation isn't altered (i.e., no bytes are added/changed/deleted).
]]

回复收藏 0 原文