1
I have applied the udp
filter in order to just capture UDP traffic, as described in Wireshark Wiki:
Show only the UDP based traffic:
udp
However, this does not only show UDP traffic. It shows UDP traffic and everything that builds on top of UDP.
Since I want to analyze our own UDP traffic only and I have not implemented a dissector yet, I am looking for a way to show only UDP traffic that cannot be identified as any other protocol.
I'd like to avoid adding a list of protocols to exclude, e.g. avoid the long list of other protocols in my filter:
udp && !http && !dhcpv6 && !bootp && !smb && !cldap && !mdns && !llmnr
How can I capture only UDP traffic that cannot be identified as another protocol?
Why don't you filter the specific UDP port that you're using? – user1686 – 2015-11-24T09:58:04.877
@grawity: each of our devices uses a different port. It is possible to find out the ports once I find packet of our devices, but I'd like to avoid the extra step – Thomas Weller – 2015-11-24T10:02:33.463