#! /bin/sh # Emulate dumbdecode.py from python netarch # What this script does: # * pmerge takes multiple pcap files and outputs a single pcap stream, # with everything in time order # * pcat outputs a line with six fields for each input packet: # * timestamp (in seconds, with millisecond precison) # * protocol (like `UDP` or `TCP`) # * source address # * destination address # * protocol options (like SYN or PSH) # * payload, hex-encoded # * For each pcat output line: # * Convert timestamp to RFC3339 format, so humans can read it # * Print a bit of header with the protocol, using python netarch formatting # * Print the source, destination, and formatted time # * Write out a hex dump of the paylaod pmerge "$@" | pcat | while read ts proto src dst opts payload; do when=$(TZ=Z date -d @${ts%.*} "+%Y-%m-%d %H:%M:%S") # Format time as human-readable printf "Packet %s None: None\n" $proto printf " %s -> %s (%s)\n" ${src%,*} ${dst%,*} "$when" echo $payload | unhex | hd echo done