Tell tcpdump to skip custom header

Question

I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers would be helpful; I don't want to write a custom discector

I wonder if you could use wireshark instead. You could try the `Disable Protocol`, it helped me to skip a socks header. — ott--, Jan 29 '13 at 23:03
See http://ask.wireshark.org/questions/5613/disable-protocol-dissection-in-tshark/5624 — jofel, Jan 30 '13 at 08:10

score 2 · Answer 1 · answered Jan 30 '13 at 14:12

2

Wireshark's editcap has a "chop" feature (-C) which can top and tail packets for exactly this purpose.

You can do it real-time like this:

 tcpdump -w - [...filter...] | editcap -F libpcap -C 16 - - | tcpdump -nlvvv -r -

answered Jan 30 '13 at 14:12

mr.spuratic

9,721
26
41

Tell tcpdump to skip custom header

1 Answers1