Free online TXT to PCAP converter

A packet-analysis application or network appliance may accept only PCAP, while diagnostic tools often export packet bytes as TXT. Converting the dump makes it possible to open the captured frames in Wireshark, filter them, and inspect their protocols.

What the TXT format is

TXT is an unstructured plain-text container with no standard encoding, packet metadata, or network format. In Internet-related work, TXT files may contain firewall logs, terminal output, packet summaries, or hexadecimal dumps exported by diagnostic tools and scripts.

Only a TXT file containing parseable packet bytes can produce a meaningful PCAP. A line containing a source address, destination address, and port describes traffic but does not contain the Ethernet, IP, and transport-layer bytes needed for a captured frame. Ordinary notes, CSV files, and decoded event logs cannot be converted back into the original packets.

What the PCAP format is

PCAP is a binary packet-capture format supported by Wireshark, tcpdump, TShark, dumpcap, and other analysis tools. A file contains a capture header followed by packet records with timestamps, captured lengths, original lengths, and raw link-layer data.

When the bytes include the relevant headers, analyzers can decode Ethernet, IPv4, IPv6, TCP, UDP, DNS, HTTP, and other protocols. PCAP supports display filters, protocol inspection, troubleshooting, replay testing, and traffic archiving. PCAPNG is a newer capture format that can store multiple interfaces and additional metadata; use PCAP when the receiving application specifically requires it.

How to convert the dump

text2pcap, distributed with Wireshark, converts ASCII hexadecimal dumps into packet records. It does not infer missing headers or reconstruct packets from prose and summary fields.

1. Open the TXT file and confirm that it contains hexadecimal byte values, usually with an offset at the start of each line. For example: 000000 00 11 22 33 44 55 66 77 88 99 aa bb 08 00. Confirm how the source marks the end of one packet and the start of the next; blank lines or reset offsets are common, but the dump format determines the correct interpretation.
2. Check that each packet contains the intended link-layer header. For an Ethernet capture, the bytes normally start with a 14-byte Ethernet header, followed by the IP header and payload. An IP-only dump must use an IP link-layer type instead of Ethernet.
3. Run text2pcap from a terminal. For Ethernet bytes and a legacy PCAP output, use:
   text2pcap -l 1 -F pcap input.txt output.pcap
-l 1 selects Ethernet (DLT_EN10MB), and -F pcap selects the PCAP container rather than the PCAPNG default used by many current Wireshark releases. Use text2pcap --help to check options for the installed version.
4. On Windows, run text2pcap.exe from the Wireshark installation directory or add that directory to the system path:
   text2pcap.exe -l 1 -F pcap input.txt output.pcap
5. Open output.pcap in Wireshark. Check packet lengths, the selected link-layer type, frame boundaries, and protocol dissection. If the TXT dump contains no timestamps, the output cannot preserve the original capture times; generated timestamps are synthetic or sequential.

For a compatible hexadecimal dump, 101convert.com can perform the conversion online without installing software. The service cannot recover packet bytes from ordinary logs or summaries, and the result still requires validation in a packet-analysis application.

Quality and compatibility limits

There is no generic, lossless conversion from arbitrary TXT to PCAP. The source must preserve raw bytes, packet boundaries, and enough information to identify the link-layer type. Missing Ethernet or VLAN headers, checksums, sequence numbers, timestamps, encryption context, and truncated payloads cannot be recreated from decoded text.

Choose the link-layer setting to match the bytes, not merely the network protocol. Selecting Ethernet for an IP-only dump can add an incorrect interpretation and produce misleading dissection. After conversion, inspect malformed checksums and truncated frames; invalid checksums may originate in the source or from network-interface checksum offloading rather than from text2pcap.