1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
#!/usr/bin/awk -f
# This file converts tcpdump output into a hexdump with
# ASCII strings on the right. It replaces packet headers
# with "*"s to reduce visual noise.
#
# Use it like:
# tcpdump -s 2000 -x [<filter options>] | reform.awk
# To save a dump:
# tcpdump -s 2000 -w dumpfile
# To replay it:
# tcpdump -x -s 2000 -r dumpfile | reform.awk
function hexvalue(nybble) {
if (nybble=="0") { return 0; }
if (nybble=="1") { return 1; }
if (nybble=="2") { return 2; }
if (nybble=="3") { return 3; }
if (nybble=="4") { return 4; }
if (nybble=="5") { return 5; }
if (nybble=="6") { return 6; }
if (nybble=="7") { return 7; }
if (nybble=="8") { return 8; }
if (nybble=="9") { return 9; }
if (nybble=="a") { return 10; }
if (nybble=="b") { return 11; }
if (nybble=="c") { return 12; }
if (nybble=="d") { return 13; }
if (nybble=="e") { return 14; }
if (nybble=="f") { return 15; }
}
# ab67 483d cac9 08ca 3efb 35f8 9406 36e8
{
if (substr($0,1,1)=="\t") {
printf(" ");
str = "";
for (i=1; i<=NF; i++) {
nybble1 = substr($(i),1,1);
nybble2 = substr($(i),2,1);
byte1 = 16*hexvalue(nybble1)+hexvalue(nybble2);
if (headerleft) {
headerleft--;
printf("** ");
str = str " ";
} else {
printf("%02X ",byte1);
if (byte1<32 || byte1>126) {
str = str ".";
} else {
str = str sprintf("%c",0+byte1);
}
}
nybble3 = substr($(i),3,1);
nybble4 = substr($(i),4,1);
if (nybble3=="" && nybble4=="") {
printf(" ");
} else {
byte2 = 16*hexvalue(nybble3)+hexvalue(nybble4);
if (headerleft) {
headerleft--;
printf("** ");
str = str " ";
} else {
printf("%02X ",byte2);
if (byte2<32 || byte2>126) {
str = str ".";
} else {
str = str sprintf("%c",0+byte2);
}
}
}
if (i==4) {
printf(" ");
}
}
for (; i<=8; i++) {
if (i==4) {
printf(" ");
}
printf(" ");
}
printf(" %s\n",str);
} else {
printf("%s\n",$0);
headerleft = 40;
}
}
|
