 | 1 | initial version |
If you refer to RFC 768, you will see that the UDP Length field is defined as follows:
Length is the length in octets of this user datagram including this
header and the data. (This means the minimum value of the length is
eight.)
The length displayed in the Info column is the UDP payload length, which is 8 bytes less than the value of the udp.length field. If you only want to match UDP packets with a payload length of 4, you will have to append, and udp.length==12.
That aside, maybe give the following filter a try instead. If it works for you, then you don't have to worry about the UDP length field at all, unless you really do only want to match UDP packets of a very specific size.
ip.addr==192.168.10.1 and udp.port==47555 and (data contains "k")