Using tshark, how would I get it to just decode and display the application layer?
For example, I can capture and decode snmp traffic using:
sudo tshark -V -i lo -d udp.port==161,snmp
This will decode all layers, from the physical layer up to the application layer (output snipped):
Frame 120: 134 bytes on wire (1072 bits), ...
Interface id: 0
....
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00...
Destination: 00:00:00_00:00:00 ...
....
Internet Protocol Version 4, Src: 127.0.0.1...
Version: 4
....
User Datagram Protocol, Src Port: snmp (161), ....
Source port: snmp (161)
....
Simple Network Management Protocol
version: v2c (1)
community: public
....
(I just want the decode from "Simple Network Management Protocol" onwards).
Other things I've considered
I'm aware of using fields output (eg -e snmp.community). Specifying all the fields for snmp would take forever...
I could use pdml output, and transform the results using XSLT. But pdml output is slow and using XSLT seems like overkill:
sudo tshark -V -T pdml -i lo -d udp.port==161,snmp
<proto name="udp" showname="User Datagram Protocol...
<field name="udp.srcport"...
<proto name="snmp" showname="Simple...
<field name="snmp.version" showname="version: v2c...