Script which can be used to reconstruct pcap and perform packet modifications from tshark json output.
This repository contains more recent and experimental changes compared to Wireshark (https://github.com/wireshark/wireshark/tree/master/tools/json2pcap).
Command tshark -T json -x and new tshark -T jsonraw output adds into hex-data output in JSON also the information on which position each field is dissected in the original frame, what is the field length, the bitmask (for not byte aligned fields) and the type. This information can be used for latter processing. One use-case is the json2pcap script included in wireshark, which assembles the protocol layers back together from upper to lowers layers. This allows revers json to pcap conversion and also the packet modification/editing/rewriting.
/wireshark/tools/json2pcap/json2pcap.py
usage: json2pcap.py [-h] [-p] infile [infile ...]
Utility to generate pcap from json format.
Packet modification:
In input json it is possible to modify the raw values of decoded fields.
The output pcap will include the modified values. The algorithm of
generating the output pcap is to get all raw hex fields from input json and
then assembling them by layering from longest (less decoded fields) to
shortest (more decoded fields). It means if the modified raw field is
shorter field (more decoded field) it takes precedence against modification
in longer field (less decoded field). If the json includes duplicated raw
fields with same position and length, the behavior is not deterministic.
For manual packet editing it is always possible to remove any not required
raw fields from json, only frame_raw is field mandatory for reconstruction.
Packet modification with -p switch:
The python script is generated instead of pcap. This python script when
executed will generate the pcap of 1st packet from input json. The
generated code includes the decoded fields and the function to assembly the
packet. This enables to modify the script and programmatically edit or
encode the packet variables. The assembling algorithm is different, because
the decoded packet fields are relative and points to parent node with their
position (compared to input json which has absolute positions).
positional arguments:
infile json generated by tshark -T jsonraw or by tshark -T json -x
optional arguments:
-h, --help show this help message and exit
-p, --python generate python payload instead of pcap (only 1st packet)
Copyright 2017, Martin Kacer <kacer.martin[AT]gmail.com>
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.