aboutsip / pkts

Pure java based pcap library capable of reading and writing to/from pcaps.
Other
198 stars 92 forks source link

Unreadable output #111

Closed ghost closed 3 years ago

ghost commented 5 years ago

The following code together with a pcap file created with tcpdump on an android emulator produces unreadable output. Opening the file with wireshark works fine.

File creation:

%ANDROID_SDK_ROOT%\emulator\emulator.exe -avd emulator1 -tcpdump out.pcap

Java-Code:

public void analyseCapFile(File pcapFile) {
        try {
            Pcap pcap = Pcap.openStream(pcapFile);
            pcap.loop(new PacketHandler() {
                @Override
                public boolean nextPacket(Packet packet) throws IOException {
                    if (packet.hasProtocol(Protocol.TCP)) {
                        System.out.println(packet.getPacket(Protocol.TCP).getPayload());
                    }
                    return true;
                }
            });
            pcap.close();
            Files.deleteIfExists(pcapFile.toPath());
        } catch (IOException e) {
            e.printStackTrace();
        }
}

Output example:

null null �-���Ž� POM(��n^o{���ʔq�[�& $ ���5\3AM^����<��Zw!(Ql ]��}��;����Q��0�(m��i8R�`���U�'G<j� �e�XDT�}vYw��ҽ�+'���ޘ�������<iץ0���r�C�}�l!�����\���->(���֪G�c�LY�f�u��fU+*Ŧ���6VR-��� ٷ�Tpo���@-����+�8Ȭ\�;V �ݨѕ�� �g��q)�gp�����d�1g�F���̩�l��T)�"d�|���M�/�H�lH��L��$��G������7����q����F[�����Hw}/�% �t�c�4ל<L���M:%,�jz�� ���i��� .�d3q�G2����r� Z�C;��ǺFl��u�`�)-���O�����D�Ik[�j5=J����i@^��)Ǖ���z�VMoDR:$~�cV����Q�-v��JnҨd\�b{/�����3zS:'�T��2C�z��6��3,�~�S۩�� e˟U�t?�Wv�U/H�-e�*gs�oN} ����Eȍ��J�� ��;x�X��U~X�p�X��o�n� �6"o�+�U�7���� /#��8>�������Ď��f�Ɉl�|��yo������ ���j���/T�0ː�u. c���c��U�s��ۇ.y � {E%Wg��+ ���1����am(���%^o�h��C��}���Cm��⵸���l"΍0~�[��6��+И9R��Q����$���~v�xPZ����s x�B+ǥ�O����Ƥ�����M"H�K�4��& [ȝY�O:� �X��W�o�� =�5�Byl�����D���Z�&+�2���&#���6�D4q��ɹ�Ik����+ ��q 69�� �R��k����6~�5�c=�/����Z{�8�Z��@V �r2�[�1�2О �:�B��}�;�?X͋P�gA/zc$9��!�4�<��3dU,� Z/ڸ���

jonbo372 commented 5 years ago

And the payload is actually textual? Wireshark may detect what it actually contains and parse it. So, what is the payload?