Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note this is just the format not the actual password). My question is, what can I do to be able to reconstruct the password fully? Thank you for your time.

  • 1
    Have you tried another capture to see if the same thing happens. You may just have a corrupt capture...
    – Rory Alsop
    Commented Oct 8, 2013 at 14:20

1 Answer 1


What does the hex dump say? In general, 8-bit and non-printables are printed as '.' by most viewers. Pretty much like this (just on a Linux prompt though):

$ echo H€llo | hd
00000000  48 e2 82 ac 6c 6c 6f 0a                           |H...llo.|

And here is an example of how to decode the hex:

$ perl -ne 'chomp; s/ //g; print pack("H".length, $_)' <<< "48 e2 82 ac 6c 6c 6f 0a"

You might also need to figure out what encoding was used and convert it to whatever your teminal is using.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .