I use tshark to export packet information from a pcap file and it works well. I now need to export the tcp\udp payload as well. I have looked at several answers - http://ask.wireshark.org/questions/3323/printing-tcp-payload-using-tshark-t-fields and http://ask.wireshark.org/questions/12431/how-to-add-data-length-column-in-wireshark-display-or-plot-payload-length-vs-packet-no and they both claim
should work. However, I only get an empty field.
I'm using Wireshark 1.10.1 on windows 7 64 bit.
asked 16 Aug '13, 11:02
There may be another way to do this, but I think if you [at least temporarily] disable all relevant upper-layer protocols, then I believe you will be able to get what you need.
For example, suppose you want to export all TCP data, which happens to be http traffic. First, in Wireshark, disable the http protocol via:
After that, you would run something along the lines of:
You may need/want to apply a filter via
answered 22 Sep '13, 18:45