My C code needs to decode some application data that were received over a socket by another application. I used the Wireshark to export the packets(many) into a C array. But the array carries all bytes comprising IP address/Port. I just need the application data.

The C array is:

static const unsigned char pkt64[393] = {
0x00, 0x04, 0x00, 0x01, 0x00, 0x06, 0xd8, 0x9d, /* ........ */
0x67, 0x16, 0x55, 0xc0, 0x00, 0x00, 0x08, 0x00, /* g.U..... */
0x45, 0x00, 0x01, 0x79, 0xf1, 0x09, 0x40, 0x00, /* E..y..@. */
0x40, 0x06, 0xc1, 0xee, 0x0a, 0x17, 0x6f, 0x35, /* @.....o5 */
0x0a, 0xd7, 0x02, 0x64, 0xe3, 0xa4, 0x18, 0x54, /* ...d...T */
0x8c, 0xa2, 0xd6, 0xb1, 0xe9, 0xa5, 0x0c, 0xd2, /* ........ */
0x80, 0x18, 0x14, 0x12, 0x87, 0xf2, 0x00, 0x00, /* ........ */
0x01, 0x01, 0x08, 0x0a, 0x4a, 0x0c, 0x9a, 0x21, /* ....J..! */
0x94, 0x8d, 0xb2, 0x23, 0x01, 0x43, 0x60, 0x00, /* ...#.C`. */
0x06, 0x00, 0x58, 0x6f, 0x12, 0x00, 0x30, 0x30, /* ..Xo..00 */
0x47, 0x00, 0x20, 0xe2, 0x82, 0x19, 0x00, 0x10, /* G. ..... */
0x10, 0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x95, /* ........ */
0x42, 0x38, 0x14, 0x04, 0x24, 0x11, 0x57, 0x14, /* B8..$.W. */
0x58, 0x12, 0x30, 0x30, 0x11, 0x00, 0x40, 0x00, /* X.00..@. */
0x39, 0x38, 0x35, 0x2d, 0x31, 0x31, 0x37, 0x00, /* 985-117. */
0x03, 0x14, 0x10, 0x00, 0x00, 0x03, 0x28, 0x00, /* ......(. */
0x01, 0x19, 0x95, 0xe2, 0xcf, 0x53, 0x13, 0xa2, /* .....S.. */
0xd5                                            /* . */

My application data starts with the bytes 0x60, 0x00, 0x06, 0x00. So I need to delete all lines and bytes up to the the application data of interest. Since I have many packets to be decoded, how do I use grep/sed to achieve my requirement?

  • 7
    Please don't post images of text! We will need to copy your sample into a test file to be able to play with it and give you a good answer. I am not about to do so manually. Please edit your question and paste the actual data. – terdon Apr 25 '14 at 11:21
  • Sorry. I realized the mistake. I have now put in a link to the data. Thanks. – Prabhu Apr 25 '14 at 11:42
  • Why don't you exported only data from your packets? – Artur Szymczak Apr 25 '14 at 16:00
  • @ArturSzymczak I wished the same. But couldn't find a way. Is it possible? – Prabhu Apr 25 '14 at 16:27

To delete the first 70 bytes:

perl -0777 -pe 's{(?:0x[0-9a-f]{2},\s*(?:/\*.*?\*/)?\s*){70}}{}'

To delete up to the first 0x60, 0x00, 0x06, 0x00:

perl -0777 -pe 'BEGIN{$c=qr{,\s*(?:/\*.*?\*/)?\s*}}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.