Wireshark-users: Re: [Wireshark-users] Is there a tshark option to save just RTP Header?
On Thu, May 03, 2007 at 05:29:24PM -0400, Kerry L Foster wrote:
> Is it possible to control what information is being saved by tshark
> into the output capture file?
The only way that I know of is the -s <snapshot len> option, which
specifies how many bytes of each packet to read/save. This could be
used in your case as long as all of the packets had the exact same
length for the lower level protocols (ethernet, ip, udp, etc.)
> I assume tshark does not support this capability which leads me to the
> next question. If I (or someone else) were to implement this
> capability (to contribute back), where would the best place be to add
> it? Could I add it as a preference within the RTP dissector (something
> like '-o rtp.clear_payload:TRUE')? Then from the RTP dissector, just
> manipulate the tvb->real_data buffer or tvb->length based upon the
> preference setting (it could simply zero out RTP payload, or maybe
> even modify the UDP/RTP lengths, etc.). It looks like dissect_packet()
> passes a pointer to the original packet data and not to a copied
> buffer, so it looks feasible.
That is probably the best place to put this sort of feature.
Steve
