Friday, August 6, 2021

Capture specific bytes only using tcpdump?

Hi,

I am using the following command to capture UDP Packets being received

tcpdump -Xnpi eth0 port 16000

Which outputs something along the likes of this:

0x0000: 4500 0025 425e ..........

0x0010: 0000 0000 0000 ..........

0x0020: 0000 1111 0000 ..........

I ultimately want to log my payload to a csv file. Let's say I want to log the 1111 to this csv, which happen to be the 34 and 35th bytes. I am unsure whether if it is possible to only look at these specific bytes. How do I focus on specific bytes to log, or view?



No comments:

Post a Comment