Skip to main content

Filter UDP packets by byte prefix

ยท One min read
Peter Johnson

Here's a handy way of logging all UDP packets which start with a specific byte prefix:

TCP Dumpโ€‹

sudo tcpdump -X -v 'udp[8:4] = 0x03050b11'

TSharkโ€‹

sudo tshark -V -f 'udp and udp[8:4] = 0x03050b11'

Wireshark UIโ€‹

You can paste this into the 'Display Filter' input:

udp contains 03:05:0b:11