Wireshark-users: Re: [Wireshark-users] Is there a tshark option to save just RTP Header?

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Thu, 31 May 2007 17:13:51 -0700

On Thu, May 03, 2007 at 05:29:24PM -0400, Kerry L Foster wrote:

> Is it possible to control what information is being saved by tshark 
> into the output capture file?

The only way that I know of is the -s <snapshot len> option, which 
specifies how many bytes of each packet to read/save.  This could be 
used in your case as long as all of the packets had the exact same 
length for the lower level protocols (ethernet, ip, udp, etc.)

> I assume tshark does not support this capability which leads me to the 
> next question. If I (or someone else) were to implement this 
> capability (to contribute back), where would the best place be to add 
> it? Could I add it as a preference within the RTP dissector (something 
> like '-o rtp.clear_payload:TRUE')?  Then from the RTP dissector, just 
> manipulate the tvb->real_data buffer or tvb->length based upon the 
> preference setting (it could simply zero out RTP payload, or maybe 
> even modify the UDP/RTP lengths, etc.). It looks like dissect_packet() 
> passes a pointer to the original packet data and not to a copied 
> buffer, so it looks feasible.

That is probably the best place to put this sort of feature.


Steve