Using text2pcap tool

The text2pcap tool is allowing you to create PCAP filed from text files. Here is a simple example how to convert a text file containing three Bluetooth 5 Advertising Extension packets into PCAP file.

sample.txt

# ADV_EXT_IND
0.0
0000 00 c1 80 00 d6 be 89 8e 13 0c d6 be 89 8e 47 0d
0010 0c 19 ec f1 95 13 df 41 b2 17 0c c3 1e 00 00 00

# ADV_AUX_IND
0.236250
0000 0e c3 80 00 d6 be 89 8e 13 0c d6 be 89 8e 47 ff
0010 06 18 b2 17 0d 53 00 5d 16 45 23 11 22 33 44 55
0020 66 77 88 99 00 11 22 33 44 55 66 77 88 99 00 11
0030 22 33 44 55 66 77 88 99 00 11 22 33 44 55 66 77
0040 88 99 00 11 22 33 44 55 66 77 88 99 00 11 22 33
0050 44 55 66 77 88 99 00 11 22 33 44 55 66 77 88 99
0060 00 11 22 33 44 55 66 77 88 99 00 11 22 33 44 55
0070 66 77 88 99 00 5d 16 56 34 11 22 33 44 55 66 77
0080 88 99 00 11 22 33 44 55 66 77 88 99 00 11 22 33
0090 44 55 66 77 88 99 00 11 22 33 44 55 66 77 88 99
00a0 00 11 22 33 44 55 66 77 88 99 00 11 22 33 44 55
00b0 66 77 88 99 00 11 22 33 44 55 66 77 88 99 00 11
00c0 22 33 44 55 66 77 88 99 00 11 22 33 44 55 66 77
00d0 88 99 00 5d 16 34 12 11 22 33 44 55 66 77 88 99
00e0 00 11 22 33 44 55 66 77 88 99 00 11 22 33 44 55
00f0 66 77 88 99 00 11 22 33 44 55 66 77 88 99 00 11
0100 22 33 44 55 66 77 88 99 00 11 22 33 44 55 66 00
0110 00 00

# ADV_CHAIN_IND
0.238740
0000 0d c3 80 00 d6 be 89 8e 13 0c d6 be 89 8e 47 26
0010 03 08 b2 17 77 88 99 00 11 22 33 44 55 66 77 88
0020 99 00 11 22 33 44 55 66 77 88 99 00 11 22 33 44
0030 55 66 77 88 99 00 00 00 00


 To convert sample.txt file into sample.pcap file uses the following invocation:

text2pcap.exe -l 256 sample.txt sample.pcap -t "%S."

Input from: sample.txt
Output to: sample.pcap
Output format: pcap
Wrote packet of 32 bytes.
Wrote packet of 274 bytes.
Wrote packet of 57 bytes.
Read 3 potential packets, wrote 3 packets (435 bytes).

You can check sample.pcap using tshark.

tshark.exe -r sample.pcap

    1   0.000000 41:df:13:95:f1:ec → Broadcast    LE LL 32  ADV_EXT_IND
    2   0.236250    Anonymous → Broadcast    LE LL 274 Service Data - 16 bit UUID,Service Data - 16 bit UUID,Service Data - 16 bit UUID AUX_COMMON
    3   0.238740    Anonymous → Broadcast    LE LL 57 0x88 AUX_COMMON

Comments

Post a Comment

Popular posts from this blog

Bluetooth 5 Advertising Extensions demo using Nordic nRF52840

Image
Nordic nRF52840 supports Bluetooth 5 Advertising Extensions but finding working example is not easy. In the whole nRF5_SDK_17.0.0 there is only one example project that is using Bluetooth 5 Advertising Extensions. It is located in  examples\ble_peripheral\ble_app_rscs  and is named "nRF Running Speed and Cadence Sensor Example Application". I have found it by greping the source for: init.config.ble_adv_extended_enabled There is no  hex file provided so you must compile it. You can do it using Segger Embedded Studio for ARM using supplied project file, or using a method that suits you best. After complication flash the nRF52840-DK board with the compiled hex file. To check the advertising of the nRF52840-DK board running hte application, I have used a mobile phone that supports Bluetooth 5 Advertising Extensions. It was a Samsung S10e mobile phone running Android 10. To scan I have used the  nRF Connect for Mobile  app. Here are two screenshots from the app showi...
Read more

Pcap files and sed

Tshark can produce output that is suitable for text2pcap tool. Here is an example how to format tshark output using sed and preserve packet arrival time. tshark.exe -r test.pcap -V -x -Y "frame.number <= 1" -T text | sed -n -e "/^\( Arrival Time\)\|^\(00\)/p" | sed -e "s/^ Arrival Time\: \([a-zA-Z]\{3\}[0-9\,\.\:\ ]\{5\}\)\([0-9\,\.\:\ ]*\).*/\n\1_\2/" The output: Jan 4, _2021 15:21:00.327645000 0000 00 06 33 01 23 67 06 0a 00 25 a8 82 69 00 00 07 ..3.#g...%..i... 0010 f7 8e 89 be d6 40 20 ee be af 26 64 a1 02 01 16 .....@ ...&d.... 0020 1a 7f 4c 00 02 15 b9 40 7f 30 f5 f8 46 6e af f9 ..L....@.0..Fn.. 0030 25 55 6b 57 fe 2d 64 85 f5 64                   %UkW.-d..d Note that year must be prefixed with _ to allow proper interpretation by text2pcap tool: text2pcap -t "%b %d, _%Y %H:%M:%S." - test_pext2pcap.pcap -l 272 Now we can use sed to manipulate packet contents between tshark and text2pcap: tshark ... | sed ... ...
Read more