How can I trim or ignore the first 8 bytes of UDP payload in a capture.

RTP
UDP
payload
bytes

asked 2020-01-08 19:23:48 +0000

A recent change to a UDP protocol is causing me grief. For this scenario a provider has added an ID in front of the RTP Header information in the payload so I can no longer dissect it correctly. Is there an easy way to trim the first 8 bytes from the UDP payload in a packet capture?

edit retag flag offensive close merge delete

Comments

Does the RTP payload always start at the same byte offset (Eth: 14 + IP: 20 + UDP: 8 + ID data: 8 = 50 ?)
If so then you might look at "chopping" out the ID bytes with editcap -C :
https://www.wireshark.org/docs/man-pa...

Chuckc ( 2020-01-08 23:05:08 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

How can I trim or ignore the first 8 bytes of UDP payload in a capture.

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

How can I trim or ignore the first 8 bytes of UDP payload in a capture. edit

Comments

1 Answer