How to read pcap file in Linux CLI using tcpdump

pcap (packet capture) files from tcpdump or other network devices are binary files. They cannot be read with text editors such as vi or nano, or file viewers such as less or cat, as shown:

[root@TUM1 tmp]# less log_traffic.pcap
ÝX¼'
ÝX¼'·%ÝPR0W<<ÿÿÿÿÿÿÐÐý|ÐÐý|\æ
þ
'PRz@@
ÌÌÍX¼'·¥2ªª

ÝX¼'
ÝX¼'·%ÝPR£o<<ÿÿÿÿÿÿÐÐý|ÐÐý|\æ
þ  w<<ÿÿÿÿÿÿÐÐý|ÐÐý|\æ
þPR
(Rg5@@
ÌÌÍX¼'·¥2ªª

Wireshark is commonly used to read pcap files, but requires GUI mode. If you are working in text mode and do not know how to read pcap there, you have to transfer the file to a machine with Wireshark. This article covers commands for reading pcap files on the Linux console. This is convenient because you do not need to move them to a machine with a program supporting pcap. Commands for reading pcap files

[root@TUM1 tmp]# tcpdump -qns 0 -X -r /path/to/file.pcap

This command displays the various fields along with hexadecimal data, as in the output below.

10:33:26.996668 IP 10.1.21.23.44504 > 10.1.21.255.netbios-ns: UDP, length 50
0x0000:  4500 004e 0000 4000 4011 fb87 0a01 1517  E..N..@.@.......
0x0010:  0a01 15ff add8 0089 003a 462d 2d50 0110  .........:F--P..
0x0020:  0001 0000 0000 0000 2046 4545 4545 4645  .........FEFCCCE
0x0030:  4646 4845 5046 4345 4d45 4543 4f45 4f45  FFHEPFCEMEECOEOE
0x0040:  4646 4543 4143 4142 4d00 0020 0001       FFECACABM.....
10:33:26.997794 IP 10.1.21.23.40439 > 10.1.21.255.netbios-ns: UDP, length 50
0x0000:  4500 004e 0000 4000 4011 fb87 0a01 1517  E..N..@.@.......
0x0010:  0a01 15ff 9df7 0089 003a 1161 71fd 0110  .........:.aq...
0x0020:  0001 0000 0000 0000 2046 4545 4545 4645  .........FEFCCCE
0x0030:  4646 4845 5046 4345 4d45 4543 4f45 4f45  FFHEPFCEMEECOEOE
0x0040:  4646 4543 4143 4142 4d00 0020 0001       FFECACABM.....

[root@TUM1 tmp]# tcpdump -ttttnnr /path/to/file.pcap

This command displays the data as tcpdump normally shows packets without special options. The file contents appear as follows:

reading from file /path/to/file.pcap, link-type EN10MB (Ethernet)
...
2013-11-11 10:33:26.996668 IP 10.1.21.23.44504 > 10.1.21.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
2013-11-11 10:33:26.997794 IP 10.1.21.23.40439 > 10.1.21.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
2013-11-11 10:33:27.267881 IP 10.1.21.23.44504 > 10.1.21.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
2013-11-11 10:33:27.268715 IP 10.1.21.23.40439 > 10.1.21.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
2013-11-11 10:33:27.541051 IP 10.1.21.23.44504 > 10.1.21.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
2013-11-11 10:33:27.541897 IP 10.1.21.23.40439 > 10.1.21.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
...