Wireshark-dev: Re: [Wireshark-dev] help with udp?
From: Bill Meier <[email protected]>
Date: Mon, 23 Mar 2009 21:11:46 -0400
Yang Ning wrote:

I'm trying to add a field for UDP data payload. So that I can use the strings to search for some information. (Like for example, I can do udp.length==12345, I want to add a payload field so that I can do something like "udp.payload contain something")
where abouts does the code for udp dissection situated?

Even simpler:

How about something like this for a filter ??

(I think this will work)

udp && (data contains ...)

(I'm not sure but you might have to disable any protocols which ride on UDP if you always want to search the complete UDP payload).

If you really want to get into the code, see the Developers Guide

as to how to download the source & build Wireshark.

The UDP dissector code is in epan/dissectors/packet-udp.c in the downloaded source.