Wireshark · Wireshark-users: Re: [Wireshark-users] Dumping only UDP payload

[Guy Harris <guy@xxxxxxxxxxxx>]

On May 1, 2008, at 9:58 AM, Tennis Smith wrote:

> I’m testing a protocol that is encapsulated in udp.  So, I want to  
> capture only the udp payload without any ip or udp headers. It needs  
> to be the entire udp payload as well, not a partial capture.
>
> Can that be done with ‘tshark’?

No:

	1) there is no DLT_ value for "UDP only";

	2) the packet capture mechanism *Shark uses (libpcap/WinPcap and the  
OS mechanisms they use) has no provision for not capturing arbitrary  
sets of headers - you get what the driver hands you.

However, I also don't see why you'd need to capture only the UDP  
payload; the mere fact that the protocol is encapsulated in UDP  
doesn't impose any such requirement.