Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note this is just the format not the actual password). My question is, what can I do to be able to reconstruct the password fully? Thank you for your time.

share|improve this question
Have you tried another capture to see if the same thing happens. You may just have a corrupt capture... – Rory Alsop Oct 8 '13 at 14:20
up vote 2 down vote accepted

What does the hex dump say? In general, 8-bit and non-printables are printed as '.' by most viewers. Pretty much like this (just on a Linux prompt though):

$ echo H€llo | hd
00000000  48 e2 82 ac 6c 6c 6f 0a                           |H...llo.|

And here is an example of how to decode the hex:

$ perl -ne 'chomp; s/ //g; print pack("H".length, $_)' <<< "48 e2 82 ac 6c 6c 6f 0a"

You might also need to figure out what encoding was used and convert it to whatever your teminal is using.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.