Question

The packets captured are nearly unable to analyze, I can not even see the source/destination address of these packets, how can i make them more friendly to analyze

Was it helpful?

Solution

The problem is that rvictl adds a header to the packet frame. To have wireshark parse them properly, add a user offset:
Edit -> Preferences -> Protocols -> DLT_USER -> Edit
Select New. The payload protocol should be "ip" (without the quotes). The Header size should be 112 if you are sniffing 3G and 108 if you are sniffing wifi. The tailer size should be 0.
Select Ok, and Ok. Wireshark should reload the currently open packets, and it should appear parsed.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top