How can I collect only Packet headers without payload?

[izatenat87]

Didn't find any way to collect headers only, without payload

[emanuele-f]

If "full payload" is disabled (default), PCAPdroid will only show the headers and the initial bytes od the payload, it takes very low memory. Do you have other needs?

[izatenat87]

Thanks you for answer! I need to capture tcpdump in file without payload(headers only), in both options("full payload" enable/disabled) I see full payload in pcap file. Is the any option to collect only headers in file?

[emanuele-f]

A pcap file cannot contain only headers, as a it contains the binary packets data. To extract the http headers, you need to process the pcap file in aome way. E.g. you can open it in Wireshark and set a filter to show http traffic

[izatenat87]

The main issue that pcap file collected using PCAPDroid on android phone is so big(in some cases I have >10 Gb pcap file), is the any way that I can limit packet size written in file, I tried to update dumpData in FileDumper, but when I cut packet payload(keep only 96 bytes headers getting an error in wireshark(due to checksum error), maybe you know way to set packet size limitation to native libpcap to avoid this error.

[emanuele-f]

The max_pkts_per_flow API option should work well in your case, check out https://github.com/emanuele-f/PCAPdroid/blob/master/docs/app_api.md