see UDP data with tshark

Question

in wireshark i can see data (click packet and goto floww UDP stream..)

but when i show data in tshark, tshark print empty line,

my command is this:

tshark -r dns.cap -T fields -e data

i want see data in packet as HEX format

Accepted Answer

In your question you called it "data", but there is no "data" field in your captured packets, and you did this command:

tshark -r dns.cap -T fields -e data

That command will print out the value of the data field - "data" is a real name of a field in Wireshark/tshark, and it usually represents un-parsed payload bytes in the packet. But your capture of a DNS query and response has no data field in it, so you see nothing print out when you run that command. The same happens if you put "data" in the display filter of Wireshark: you won't see any packets displayed because no packet in your capture has a data field.

When you select "Follow UDP stream" in Wireshark, it shows you the raw UDP payload bytes of the UDP packet(s) of the UDP conversation, but they're not a "data" field.

I don't know of any tshark command which will print the UDP payload as raw bytes/hex directly. There are other, indirect, ways of getting the payload. One way is to follow the directions given in the answer to this previous question, by using the Lua script shown in that answer and using the following command for your case:

tshark -r dns2.cap -X lua_script:extract.lua -X lua_script1:dns -T fields -e extractor.value.hex

Answer 2

Which bit of the "data" do you want, the Ethernet header, the IP header, the UDP Header or the DNS query and response?

You can get all of the hex bytes with -x.