 | 1 | initial version |
If you're happy with "the packets that contain IPv6 or IPv6, as a pcap, starting at the IP layer with Raw IP encapsulation", then do this:
"File -> Strip Headers" Select "IP" from the drop down. Click Ok. Save the resultant file. Done.
You lose the IEEE MAC layer, the common LLC layer, the radio tap information, and anything that isn't IP, e.g. you'll lose the EAPOL packets (might be a feature not bug for you), ARP, rarer stuff like oh AppleTalk ARP, etc. But the IP will be decrypted.
| | 2 | No.2 Revision |
If you're happy with "the packets that contain IPv6 or IPv6, as a pcap, starting at the IP layer with Raw IP encapsulation", then do this:
"File -> Strip Headers" Select "IP" from the drop down. Click Ok. Save the resultant file. Done.
You lose the IEEE MAC layer, the common LLC layer, the radio tap information, and anything that isn't IP, e.g. you'll lose the EAPOL packets (might be a feature not bug for you), ARP, rarer stuff like oh AppleTalk ARP, etc. But the IP will be decrypted.decrypted and easily read in tools besides Wireshark because it uses the Raw IP encapsulation.
