Save a custom range of bytes to .pcapng

UDP
save

asked 2024-08-29 08:22:21 +0000

Hello,

I'm using wireshark to capture UDP. The packets are 1560 bytes. However, the useful data is only present in the first 50 bytes.

So far I've saved everything to .pcapng files and used a script to get what I want. This is long and bothersome.

Is there a way to save only a custom range of bytes for all packets directly with Wireshark ?

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2024-08-29 11:23:10 +0000

Chuckc
2968 ●6 ●596 ●20

To capture less data, look at setting a snaplen in the Capture Options.

To modify an existing capture file, try -C or -s options of the editcap command.

edit flag offensive delete link

Comments

Thank you :) Snaplen takes care of it.

I'm gonna look at the editcap command to improve my process further.

LeMaccou ( 2024-08-29 13:57:22 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2024-08-29 08:22:21 +0000

Seen: 26 times

Last updated: Aug 29

Save a custom range of bytes to .pcapng edit