|
Question : viewing hex output in tcpdump
|
|
Is there any advantage in displaying hex output? ( -x switch)? Currently I use tcpdump with the -n -e -s 1514 switches. Does viewing hex have any advantages? Are you viewing the actual encapsulated data when you do this?
Also, is it true that the ascii interpretation of the hex is also shown? I heard the asci after each line of hex, was the hex in ascii (wow does that make sense?) Thanks
|
Answer : viewing hex output in tcpdump
|
|
Can't specifically comment on tcpdump, but the conventional form for hex dumps is to show about 16 bytes in hex (2 digits+space each), a spacer column, and then the same 16 bytes in ACSII with "." substituted for any that aren't prinatble. So any text fields are readable on the right, but you've got the actual bits on the left.
|
|
|
|