tshark - only output application layer decode

Question

Using tshark, how would I get it to just decode and display the application layer?

For example, I can capture and decode snmp traffic using:

sudo tshark -V -i lo -d udp.port==161,snmp

This will decode all layers, from the physical layer up to the application layer (output snipped):

Frame 120: 134 bytes on wire (1072 bits), ...
    Interface id: 0
    ....
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00...
    Destination: 00:00:00_00:00:00 ...
    ....
Internet Protocol Version 4, Src: 127.0.0.1...
    Version: 4
    ....
User Datagram Protocol, Src Port: snmp (161), ....
    Source port: snmp (161)
    ....
Simple Network Management Protocol
    version: v2c (1)
    community: public
    ....

(I just want the decode from "Simple Network Management Protocol" onwards).

Other things I've considered

I'm aware of using fields output (eg -e snmp.community). Specifying all the fields for snmp would take forever...

I could use pdml output, and transform the results using XSLT. But pdml output is slow and using XSLT seems like overkill:

sudo tshark -V -T pdml -i lo -d udp.port==161,snmp

<proto name="udp" showname="User Datagram Protocol...
    <field name="udp.srcport"...
<proto name="snmp" showname="Simple...
    <field name="snmp.version" showname="version: v2c...

Answer 1

You can use the -O option, as indicated by the help output:

-O <protocols> Only show packet details of these protocols, comma separated

$ tshark -i 4 -O snmp -q -V > snmp.txt

See also the TShark man-page:

-O Similar to the -V option, but causes TShark to only show a detailed view of the comma-separated list of protocols specified, rather than a detailed view of all protocols. Use the output of "tshark -G protocols" to find the abbreviations of the protocols you can specify.