Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

tshark get only application level data bytes

I'm using tshark to get a .csv of various fields, and I want the application level data (above tcp/udp) as one of the fields. For some of the frames I can get this from "" but not for the frames whose application level protocol has already been dissected.

Is there a way to get just the (app-level) data above tcp/udp layer (in either raw bytes or hex string) for all of the frames? I don't want to use "-x" or something like that to get all of the bytes since then I have to first remove the lower-level layers.