Question

Here is a tcpdump hex output of a captured packet.

Command used was ..

$ tcpdump -X -s0 protochain <portno> 

0x0000:  6000 0000 0080 3220 0000 0000 0000 0000  ................
0x0040:  0000 0000 0000 0001 0000 0000 0000 0000  ................
0x0090:  6174 6500 0000 0329                      ........

these ... could be anything they are respective ascii charaters corresponding to the specified hex characters. I need to extract the middle hex portion.

I need output in the following format. Please suggest me something on this.

6000 0000 0080 3220 0000 0000 0000 0000
0000 0000 0000 0001 0000 0000 0000 0000
6174 6500 0000 0329 

I tried this one but that seems incorrect ..

cut -d ":" -f2 tmp_packet.txt | awk -F " " '{printf "%s %s %s %s %s %s %s %s 
\n",$1,$2,$3,$4,$5,$6,$7,$8}' > packet.txt

tried something with cut -b also but that is giving weird output.

If possible suggest something with awk NRand NF. I am new to awk so do not know much about them.

I tried this and get those ... as output.

cut -d ":" -f2 tmp_packet.txt | awk -F " " '{printf "%s\n",$NF}' > packet.txt

output :

................
................
........

Is there any way using awk to print all the columns except the last one (that is to print everything except the above specified).

Answer 1

Cut by spaces: cut -d " " -f 3-10