3

I have applied the udp filter in order to just capture UDP traffic, as described in Wireshark Wiki:

Show only the UDP based traffic: udp

However, this does not only show UDP traffic. It shows UDP traffic and everything that builds on top of UDP.

Since I want to analyze our own UDP traffic only and I have not implemented a dissector yet, I am looking for a way to show only UDP traffic that cannot be identified as any other protocol.

I'd like to avoid adding a list of protocols to exclude, e.g. avoid the long list of other protocols in my filter:

udp && !http && !dhcpv6 && !bootp && !smb && !cldap && !mdns && !llmnr

How can I capture only UDP traffic that cannot be identified as another protocol?

2
  • Why don't you filter the specific UDP port that you're using? Commented Nov 24, 2015 at 9:58
  • @grawity: each of our devices uses a different port. It is possible to find out the ports once I find packet of our devices, but I'd like to avoid the extra step Commented Nov 24, 2015 at 10:02

1 Answer 1

3

First note that you're working with Wireshark's display filters, separate (and very different) from libpcap's capture filters. (libpcap itself has an udp filter, but it only understands very few protocols. So you'll be capturing everything, but filtering the displayed list.)

In Wireshark, the "Frame" section has various metadata about the dissected packet, for example:

Protocols in frame: eth:ethertype:ip:udp:dns

This corresponds to the frame.protocols field. Now apply a regex match using ~ or matches:

udp && frame.protocols ~ ":udp$"

This will match all packets where the last recognized protocol was UDP (i.e. frame.protocols ends with the text :udp). Be careful – some traffic might be mis-detected as some obscure protocol even though it isn't.

(The udp && prefix is an optimization – a protocol match might be more efficient for discarding non-UDP traffic than a string regex match.)

1
  • 3
    It seems I need frame.protocols ~ ":udp:data$" - maybe that is new in Wireshark 2.0 Commented Nov 24, 2015 at 10:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .