Wireshark-users: Re: [Wireshark-users] Dumping only UDP payload

From: Sake Blok <sake@xxxxxxxxxx>
Date: Thu, 1 May 2008 20:26:10 +0200

On Thu, May 01, 2008 at 11:58:05AM -0500, Tennis Smith wrote:
> 
> I'm testing a protocol that is encapsulated in udp.  So, I want to
> capture only the udp payload without any ip or udp headers. It needs to
> be the entire udp payload as well, not a partial capture.

If I understand you correctly, you want to extract the payload of
an UDP conversation and save it in a file?

> Can that be done with 'tshark'? 

No, but I wrote a little perl script that does that, have a look at:

http://www.wireshark.org/lists/wireshark-users/200611/msg00133.html

Does that suit your needs?

Cheers,
    Sake