Hi,
I am not that familiar with the filters of wireshark while capturing and displaying.
I went through the filters section of the documents page. All the filters mentioned in the help sections are present for selective acceptance of the packet based on filters and doing a selective display. Once the packet successfully goes through the filter, the entire packet with all the headers are stored in the capture file.

 

My requirement is once the packet clears the filter [ say ip = 11:22:33:44 ],can  wireshark rip all the protocol headers and store only the payload/data part of an udp packet while storing it to a file?

I donot want wire shark to store the entire packets. I want it to capture in a file only the data part of a udp packet. Is this doable through the filters and dissectors part of wireshark or tcpdump?

thanks

regards
Vijaya