Wireshark-users: Re: [Wireshark-users] Dumping only UDP payload

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 1 May 2008 11:12:47 -0700

On May 1, 2008, at 9:58 AM, Tennis Smith wrote:

I’m testing a protocol that is encapsulated in udp. So, I want to capture only the udp payload without any ip or udp headers. It needs to be the entire udp payload as well, not a partial capture.

Can that be done with ‘tshark’?

No:

	1) there is no DLT_ value for "UDP only";

2) the packet capture mechanism *Shark uses (libpcap/WinPcap and the OS mechanisms they use) has no provision for not capturing arbitrary sets of headers - you get what the driver hands you.

However, I also don't see why you'd need to capture only the UDP payload; the mere fact that the protocol is encapsulated in UDP doesn't impose any such requirement.