to read the packet data from a cap file

Question

i need to read the payload information from a udp packet which is in pcap file.

tshark -x -c 10 -r traces/trace.pcap udp

0000 00 22 4d a8 1f 7f 80 3f 5d 08 52 35 08 00 45 00 ."M....?].R5..E. 0010 05 94 03 e6 40 00 40 11 3b 46 c0 a8 ba 6c c0 a8 ....@.@.;F...l.. 0020 ba 6f d4 80 05 dc 05 80 4e 9e 00 00 80 25 1b 3a .o......N....%.: 0030 fd 9e 00 00 00 01 00 00 00 06 5b 29 c2 5b 78 ed ..........[).[x. 0040 00 00 1b 6f c2 5b 78 ed 00 00 1e c4 30 5b 00 00 ...o.[x.....0[.. 0050 00 00 85 c7 09 00 00 00 00 00 01 00 00 00 06 00 ................ 0060 00 00 c0 07 1c 00 00 00 00 00 c0 07 3c 00 00 00 ............<... 0070 00 00 c0 07 3c 00 00 00 00 00 78 78 78 78 78 78 ....<.....xxxxxx

i get the above output from tshark but the payload consists of packet arrival and departure time from a udp server how i need to retrieve arrival and departure time from above information.

Answer 1

To print both the packet as hex (-x) and the summary with the timestamp in tshark add the -P option. To get the timestamp as absolute instead of relative value add the -ta option. For more information see the documentation.