Ask Your Question

How can I export UDP payload without using the slow Follow UDP Stream method

asked 2019-01-31 10:32:06 +0000

HiZ gravatar image

As per title, how can I export some UDP payload to a file quickly. The only method I know which works is to 'Follow UDP Stream, then Save As raw. The Save option is not available for a long time (file size dependant), whilst the stream is analoysed. Is there a quicker way to simply export. Unfortuntaltley the Export Packet Dissections option doesnt work as that inclides the headers.

For reference, with UDP streams which incliude RTP, the RTP Analyse and Save Unsynchronised Forward Audio Stream as raw method works very well.


edit retag flag offensive close merge delete


I'm also interested in finding an answer to this question for 3.x (but can't upvote due to rep). You can use the 'legacy' (gtk) interface with 2.x and it performs fine when using the follow stream feature for large streams (I was using that for capturing video streams until the linux distribution I use updated the package to 3.0.0).

With the release of 3.0.0, it looks like qt is the only option and it seems we're stuck with waiting for even moderately large streams or reverting to old software.

srainey gravatar imagesrainey ( 2019-03-26 15:48:24 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-03-26 17:43:28 +0000

Ross Jacobs gravatar image

This will export the UDP payload in a way you can add to a script:

tshark -r <infile> -Y " eq <stream#>" -w <outfile>

tshark has other options for following streams like -z, and it's worth checking out the man page for more details.

In response to @srainey, I doubt that this is related to UI as tshark and wireshark both take ~3s to find a 200 packet stream in a 200MB file in my testing.

@HiZ If you continue to see a discrepancy between follow generic UDP stream and follow RTP stream, please create a bug. What we would be looking for specifically would be a way to replicate what you're finding, ideally with pcaps and all relevant info).

edit flag offensive delete link more


I think the problem is when you have a large amount of data in the filtered stream - there are times when I have to analyze mpeg2 transport streams outside wireshark. The easiest way to get the stream into an external tool is from the wireshark gui using the "Follow UDP stream" dialog (I usually have no need for the PCAP files). At the rates I'm running if I capture about 60 seconds of video (44MB, 33,000 packets), I have to wait for the qt gui to count packets for 16s before I can press the save button.

srainey gravatar imagesrainey ( 2019-03-26 18:00:36 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-01-31 10:32:06 +0000

Seen: 78 times

Last updated: Mar 26