Is there any way to export a set of captured UDP packets as separate files with just the UDP payload?

asked 2018-12-04 03:40:40 +0000

seanrowens
1 ●1 ●1 ●1

I've captured some logs of MAVLink running over UDP, now I'd like to somehow export just the UDP payload bytes of each packet, separately, from wireshark to files. Preferably with something like filenames specifying source/origin IP and port. (Although in this particular case everything is on the same IP.)

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2018-12-05 11:08:14 +0000

Jasper
24103 ●5 ●111 ●292 Düsseldorf, Germany

Maybe tshark can help a little with that, by using -Tfields and -e to export the data.data field, which will contain the colon separated hex values of the UDP payload, e.g.

tshark -r test.pcapng -Tfields -e data.data

You would probably need to convert the ascii hex stuff back to something binary afterwards, but it could do what you need.

edit flag offensive delete link

add a comment

answered 2018-12-04 06:57:09 +0000

Jaap

13742 ●711 ●115

Having Wireshark spit out individual files per frame is not something it can do (although for a datagram type protocol that wouldn't be strange thing, in order to preserve message boundaries).

One way to do this is to export the data as a text file (e.g., in JSON or PDML) and post process from there.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2018-12-04 03:40:40 +0000

Seen: 2,511 times

Last updated: Dec 05 '18

Is there any way to export a set of captured UDP packets as separate files with just the UDP payload? edit

2 Answers