i have this pcap file
but when i show data in
my command is this:
i want see
asked 31 Dec '14, 03:32
In your question you called it "
That command will print out the value of the
When you select "Follow UDP stream" in Wireshark, it shows you the raw UDP payload bytes of the UDP packet(s) of the UDP conversation, but they're not a "
I don't know of any tshark command which will print the UDP payload as raw bytes/hex directly. There are other, indirect, ways of getting the payload. One way is to follow the directions given in the answer to this previous question, by using the Lua script shown in that answer and using the following command for your case:
answered 31 Dec '14, 12:02
Which bit of the "data" do you want, the Ethernet header, the IP header, the UDP Header or the DNS query and response?
You can get all of the hex bytes with
answered 31 Dec '14, 06:25