How to record packet/frames data without a pcap header
0
votes
1
answer
197
views
I'm trying to capture raw/binary Ethernet traffic from my interface, so I can parse it using C. I don't want to parse any PCAP headers. I would prefer without the preamble and end bytes, but it's okay if it's easier to include.
Unfortunately when I capture using Wireshark it always adds a PCAP header.
Consequently I tried Tcpdump:
sudo tcpdump -w - -U | tee ~/test.raw
.
However, I open the file in Wireshark, View, Reload as File Format/Capture and it also added a pcap header (see below).
How can I record the raw frame + packets without any PCAP information?

Asked by intrigued_66
(181 rep)
Jul 13, 2024, 07:30 PM
Last activity: Jul 13, 2024, 07:47 PM
Last activity: Jul 13, 2024, 07:47 PM