Hello, Does anyone know the easier way to get only the payload of IP packets ("data" on IP datagram). Indeed, when I capture packets, it returns me the entire datagram (with the addresses ...) but I only need the payload. Thanks, Regards asked 14 Jul '14, 12:41 chi edited 14 Jul '14, 12:44 |
One Answer:
easier than what?
sure, that's what Wireshark is mainly used for. Troubleshooting network problems. For that you need several parts of the packets, especially the headers and also the payload. It depends on the problem.
You can extract the payload with tshark or other pcap extraction tools. As you did not tell us enough details, I can only answer in a general way. There are several ways to extract the payload of frames.
and then parse the tshark pdml output.
and then parse the tshark output.
and then parse the tshark output. See the tshark man page for more details. There are also other tools to extract data from a pcap file:
If that isn't what you are looking for: Please add more details to your question! Regards answered 15 Jul '14, 02:43 Kurt Knochner ♦ |
That seems perfect, thanks a lot !
Regards, Chi
You're welcome.