Closed ghost closed 3 years ago
The following code together with a pcap file created with tcpdump on an android emulator produces unreadable output. Opening the file with wireshark works fine.
File creation:
%ANDROID_SDK_ROOT%\emulator\emulator.exe -avd emulator1 -tcpdump out.pcap
Java-Code:
public void analyseCapFile(File pcapFile) { try { Pcap pcap = Pcap.openStream(pcapFile); pcap.loop(new PacketHandler() { @Override public boolean nextPacket(Packet packet) throws IOException { if (packet.hasProtocol(Protocol.TCP)) { System.out.println(packet.getPacket(Protocol.TCP).getPayload()); } return true; } }); pcap.close(); Files.deleteIfExists(pcapFile.toPath()); } catch (IOException e) { e.printStackTrace(); } }
Output example:
null null �-���Ž� POM(��n^o{���ʔq�[�&$ ���5\3AM^����<��Zw!(Ql]��}��;����Q��0�(m��i8R�`���U�'G<j��e�XDT�}vYw��ҽ�+'���ޘ�������<iץ0���r�C�}�l!�����\���->(���֪G�c�LY�f�u��fU+*Ŧ���6VR-��� ٷ�Tpo���@-����+�8Ȭ\�;V �ݨѕ�� �g��q)�gp�����d�1g�F���̩�l��T)�"d�|���M�/�H�lH��L��$��G������7����q����F[�����Hw}/�% �t�c�4ל<L���M:%,�jz�� ���i���.�d3q�G2����r�Z�C;��ǺFl��u�`�)-���O�����D�Ik[�j5=J����i@^��)Ǖ���z�VMoDR:$~�cV����Q�-v��JnҨd\�b{/�����3zS:'�T��2C�z��6��3,�~�S۩�� e˟U�t?�Wv�U/H�-e�*gs�oN} ����Eȍ��J�� ��;x�X��U~X�p�X��o�n� �6"o�+�U�7����/#��8>�������Ď��f�Ɉl�|��yo������ ���j���/T�0ː�u.c���c��U�s��ۇ.y � {E%Wg��+ ���1����am(���%^o�h��C��}���Cm�����l"0~�[��6��+И9R��Q����$���~v�xPZ����s x�B+ǥ�O����Ƥ�����M"H�K�4��& [ȝY�O:� �X��W�o�� =�5�Byl�����D���Z�&+�2���&#���6�D4q��ɹ�Ik����+ ��q69���R��k����6~�5�c=�/����Z{�8�Z��@V �r2�[�1�2О �:�B��}�;�?X͋P�gA/zc$9��!�4�<��3dU,�Z/ڸ���
And the payload is actually textual? Wireshark may detect what it actually contains and parse it. So, what is the payload?
The following code together with a pcap file created with tcpdump on an android emulator produces unreadable output. Opening the file with wireshark works fine.
File creation:
Java-Code:
Output example: