andres@unera:~$ cat /tmp/arp.txt 000000 ff ff ff ff ff ff 52 54 00 12 34 56 08 06 00 01 000010 08 00 06 04 00 01 52 54 00 12 34 56 c8 01 01 c9 000020 00 00 00 00 00 00 c8 01 01 fe andres@unera:~$ text2pcap /tmp/arp.txt /tmp/arp-output.pcap Input from: /tmp/arp.txt Output to: /tmp/arp-output.pcap Output format: pcap Wrote packet of 42 bytes. Read 1 potential packet, wrote 1 packet (82 bytes). andres@unera:~$ tcpdump -n -r /tmp/arp-output.pcap reading from file /tmp/arp-output.pcap, link-type EN10MB (Ethernet) 16:27:13.000000 ARP, Request who-has 200.1.1.254 tell 200.1.1.201, length 28 andres@unera:~$ tcpdump -n -vvv -r /tmp/arp-output.pcap reading from file /tmp/arp-output.pcap, link-type EN10MB (Ethernet) 16:27:13.000000 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 200.1.1.254 tell 200.1.1.201, length 28 andres@unera:~$ tshark -n -r /tmp/arp-output.pcap 1 0.000000 52:54:00:12:34:56 -> ff:ff:ff:ff:ff:ff ARP 42 Who has 200.1.1.254? Tell 200.1.1.201 andres@unera:~$ wireshark /tmp/arp-output.pcap (Copy bytes as hexdump) andres@unera:~$ tshark -n -r /tmp/arp-output.pcap -x 0000 ff ff ff ff ff ff 52 54 00 12 34 56 08 06 00 01 ......RT..4V.... 0010 08 00 06 04 00 01 52 54 00 12 34 56 c8 01 01 c9 ......RT..4V.... 0020 00 00 00 00 00 00 c8 01 01 fe .......... andres@unera:~$ tcpdump -n -r /tmp/arp-output.pcap -xx reading from file /tmp/arp-output.pcap, link-type EN10MB (Ethernet) 16:27:13.000000 ARP, Request who-has 200.1.1.254 tell 200.1.1.201, length 28 0x0000: ffff ffff ffff 5254 0012 3456 0806 0001 0x0010: 0800 0604 0001 5254 0012 3456 c801 01c9 0x0020: 0000 0000 0000 c801 01fe andres@unera:~$ tshark -r /tmp/arp.pcap -x | head -5 0000 ff ff ff ff ff ff 00 13 80 66 dc d5 08 06 00 01 .........f...... 0010 08 00 06 04 00 01 00 13 80 66 dc d5 a3 0a 00 01 .........f...... 0020 00 00 00 00 00 00 a3 0a 00 06 00 00 00 00 00 00 ................ 0030 00 00 00 00 00 00 00 00 00 00 00 00 ............