Wireshark
has a handy feature which can follow TCP
stream, but sometimes, it may not work as you expect. Check following diagram:
The IP
packet carries a GTP
payload, but since it is fragmented, and only first one is captured, so Wireshark
won’t dissect it, and if you try follow TCP
stream of this session, this packet will be ignored.
stripe is a cool tool which can peel away encapsulating headers. But from my testing, you should add -f
option, otherwise the IP fragmented packet which I mentioned previously will be skipped, but even with this option, stripe
will not remove the headers. So I write a simple program which just removes headers for specified packet (The code is here for reference).