Revision history  [back]

Maybe tshark can help a little with that, by using -Tfields and -e to export the data.data field, which will contain the colon separated hex values of the UDP payload, e.g.

tshark -r test.pcapng -Tfields -e data.data

You would probably need to convert the ascii hex stuff back to something binary afterwards, but it could do what you need.