Index

It took me a while to figure out how to dump the content of UDP packets with tcpdump/Wireshark. Here’s how you do it:

# Dump all the UDP traffic going to port 1234 into dump.pcap
$ sudo tcpdump -i lo -s 0 -w dump.pcap udp and port 1234
# Then we print the data on stdout
$ tshark -r dump.pcap -T fields -e data

This will print all the data in hex-encoded form, 1 packet per line. You’ll have to decode it to get the data in binary form. The following Python program does that:

import sys

for line in sys.stdin:
    # Binary data
    data = line.rstrip('\n').decode('hex')
    print repr(data)