RADECODE(1)

📦
version 5.0.2+git20250321.41f65e2 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ RADECODE ✨

okay bestie, gather round, because radecode is literally the ✨main character✨ of "wait, what was actually in that flow??" and I'm obsessed 💖

🦋 NAME 🦋

radecode — a tshark-like decode of argus(1) user data 🕵️♀️

🎀 SYNOPSIS 🎀

radecode -r argusFlowFile

💅 DESCRIPTION 💅

So. Radecode is a perl script, no cap, and it borrows text2pcap(1) and tshark(1) from the wireshark(1) distribution to decode TCP and UDP flow associated user data out of an argus flow capture file. It's giving forensic girlboss, fr fr 🧚

🚨 IMPORTANT BESTIE ALERT 🚨 you must enable argus user data capture with the -U nnnn option, or there will be no data to decode. Like, nothing. Zero. A whole lotta nothing. 😭

And because test2pcap has limitations (ugh, tragic), only TCP and UDP flows get decoded. Every other flow data type is silently ignored — no error, no warning, just quietly minding its own business 🙈

🌈 OPTIONS 🌈

  • In addition to the source file name, all ra(1) options are available — but they may not make sense 💀 like, they're there, they're just not necessarily serving cunt in this context, yk?

🔥 SEE ALSO 🔥

Copyright (c) 2000-2024 QoSient. All rights reserved. 🫶

🌸 AUTHORS 🌸

  • Carter Bullard
  • Dave Edelman

the icons who built the thing 💜

💀 BUGS 💀

(no bugs listed… which is either iconic or deeply suspicious and honestly I respect both readings ✨)

okay that's the whole vibe check, bestie — this was radecode 5.0.3, dated 09 July 2023, and that's periodt 💅🎀🦋

📦 where this page comes from