Skip the IP headers with tcpdump

python, ssdp, tcpdump, udp

Solution

Sadly there are no `tcpdump` or even `tshark` shortcuts to do what you want... the best we can do is run STDOUT through a text filter...

Some `perl` or `sed` guy will probably come behind me and shorten this, but it gets the job done...

[mpenning@Bucksnort ~]$ sudo tcpdump -Aq udp port 1900 | perl -e 'while ($line=<STDIN>) { if ($line!~/239.255.255.250.+?UDP/) { if ($line=~/(NOTIFY.+)$/) {print "$1\n";} else {print $line;}}}'
NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900

[mpenning@Bucksnort ~]$

If you add line-breaks, the perl `STDIN` filter listed above is...

while ($line=<STDIN>) {
    if ($line!~/239.255.255.250.+?UDP/) {
        if ($line=~/(NOTIFY.+)$/) {
            print "$1\n";
        } else {
            print $line;
        }
    }
}

Problem

I'm using `tcpdump` to debug an SSDP service. ``` $ sudo tcpdump -Aq udp port 1900 ``` When printing the UDP packets, I'm getting a lot of gibberish before the HTTP headers I presume to be the IP and UDP headers. How do I suppress printing these, and just print the application level data in the packet (which includes the HTTP headers)? Here's an example, the stuff I don't want is prior to `NOTIFY` on the second line: ``` 14:41:56.738130 IP www.routerlogin.com.2239 > 239.255.255.250.1900: UDP, length 326 E..b..@................l.N..NOTIFY * HTTP/1.1 HOST: 239.255.255.250:1900 ```

Original source