Wireshark-users: Re: [Wireshark-users] Is there a tshark option to save just RTP Header?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 31 May 2007 17:19:41 -0700

On May 31, 2007, at 5:13 PM, Stephen Fisher wrote:

On Thu, May 03, 2007 at 05:29:24PM -0400, Kerry L Foster wrote:

Is it possible to control what information is being saved by tshark
into the output capture file?

The only way that I know of is the -s <snapshot len> option, which
specifies how many bytes of each packet to read/save.  This could be
used in your case as long as all of the packets had the exact same
length for the lower level protocols (ethernet, ip, udp, etc.)

Unfortunately, that can be used to *throw away* the RTP header, but can't be used to save *only* the RTP header - a snapshot length of N means "save only the first N bytes of the packet".