#!/usr/bin/awk -f# This file converts tcpdump output into a hexdump with# ASCII strings on the right.  It replaces packet headers# with "*"s to reduce visual noise.## Use it like:#  tcpdump -s 2000 -x [<filter options>] | reform.awk# To save a dump:#  tcpdump -s 2000 -w dumpfile# To replay it: # tcpdump -x -s 2000 -r dumpfile | reform.awkfunction hexvalue(nybble) {    if (nybble=="0") { return  0; }    if (nybble=="1") { return  1; }    if (nybble=="2") { return  2; }    if (nybble=="3") { return  3; }    if (nybble=="4") { return  4; }    if (nybble=="5") { return  5; }    if (nybble=="6") { return  6; }    if (nybble=="7") { return  7; }    if (nybble=="8") { return  8; }    if (nybble=="9") { return  9; }    if (nybble=="a") { return 10; }    if (nybble=="b") { return 11; }    if (nybble=="c") { return 12; }    if (nybble=="d") { return 13; }    if (nybble=="e") { return 14; }    if (nybble=="f") { return 15; }}#                         ab67 483d cac9 08ca 3efb 35f8 9406 36e8{    if (substr($0,1,1)=="\t") {        printf("    ");        str = "";        for (i=1; i<=NF; i++) {            nybble1 = substr($(i),1,1);            nybble2 = substr($(i),2,1);            byte1 = 16*hexvalue(nybble1)+hexvalue(nybble2);            if (headerleft) {                headerleft--;                printf("** ");                str = str " ";            } else {                printf("%02X ",byte1);                if (byte1<32 || byte1>126) {                    str = str ".";                } else {                    str = str sprintf("%c",0+byte1);                }            }                        nybble3 = substr($(i),3,1);            nybble4 = substr($(i),4,1);            if (nybble3=="" && nybble4=="") {                printf("   ");            } else {                byte2 = 16*hexvalue(nybble3)+hexvalue(nybble4);                if (headerleft) {                    headerleft--;                    printf("** ");                    str = str " ";                } else {                    printf("%02X ",byte2);                    if (byte2<32 || byte2>126) {                        str = str ".";                    } else {                        str = str sprintf("%c",0+byte2);                    }                }            }            if (i==4) {                printf("  ");            }        }        for (; i<=8; i++) {            if (i==4) {                printf("  ");            }            printf("      ");        }        printf("   %s\n",str);    } else {        printf("%s\n",$0);        headerleft = 40;    }}