This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark: how to limit packet to beginning of data

0

I found that "-e data" can be use to display the packet content. Is there a modified to limit it to only certain bytes of a packet? In fact, what I'm looking for is the beginning of the UDP payload

Here's the command I'm currently using:

tshark -r [file] -T fields -e frame.time_relative -e data

asked 11 Dec '14, 21:33

fseto's gravatar image

fseto
11112
accept rate: 0%