On May 1, 2008, at 9:58 AM, Tennis Smith wrote:
I’m testing a protocol that is encapsulated in udp. So, I want to
capture only the udp payload without any ip or udp headers. It needs
to be the entire udp payload as well, not a partial capture.
Can that be done with ‘tshark’?
No:
1) there is no DLT_ value for "UDP only";
2) the packet capture mechanism *Shark uses (libpcap/WinPcap and the
OS mechanisms they use) has no provision for not capturing arbitrary
sets of headers - you get what the driver hands you.
However, I also don't see why you'd need to capture only the UDP
payload; the mere fact that the protocol is encapsulated in UDP
doesn't impose any such requirement.
