Wireshark · Wireshark-users: Re: [Wireshark-users] Extracting payload from ethernet dumps

[Sake Blok <sake@xxxxxxxxxx>]

On 27 sep 2010, at 16:49, Simon Greifswald wrote:

> I have several gigabytes of dumped network traffic in files, and I need to 
> extract the payload from each packet. So, I want to discard all link layer, 
> internet layer, transport layer headers and only extract the udp packet's 
> payload in a new file.

For TCP you can use "tcpflow":

tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.

(http://www.circlemud.org/~jelson/software/tcpflow/)


This does of course not work for UDP, but putting UDP payloads together from a trace that contains one "conversation" can be done easily with the script attached to the following message:

http://www.wireshark.org/lists/wireshark-users/200611/msg00133.html


Hope this helps,
Cheers,


Sake