Revision history  [back]

If the IP header doesn't vary in length, try to chop out the byte with editcap:
https://ask.wireshark.org/question/14019/how-can-i-trim-or-ignore-the-first-8-bytes-of-udp-payload-in-a-capture/