Sometimes I have to use
tcpdump to troubleshoot problems with networking protocols that
tcpdump does not know how to parse.
Is there a utility that could read tcpdump packets in hex dump format and then parse them according to structure I specified for this utility?
tcpdump -nxi any udp | the_utility "Packet_id:%d@60"
for each packet would print:
Packet_id:1 Packet_id:2 Packet_id:4 Packet_id:3
The idea is that at offset 60 there is 32 bit integer that I want to be printed in decimal format to STDOUT.
I understand that IP fragmentation and TCP reassembly would require to pass along some state to the next hex dump for it to be properly interpreted. Let's assume this is not a problem for me. Nevertheless if you know of an elegant solution that could solve this, then that would be great.
While I like Wireshark, I don't always have an option to copy packet capture files to my workstation for offline inspection. Also, these are production appliances where I have to run tcpdump - this means that I need a solution where I would not have to install anything extra.