TSHARK does't accept filters when reading from files, so I combinates tshark with tcpdump. tcpdump -r something.pcap udp and port 53 -w - | tshark -r - -V | lessyou know that tshark filter expression is storonger than tcpdump's.なんだかな…

Recently, I have learned that the UDP checksum is optional, i.e. the value can be zero, which means not to be calculated. When I got to know, I thought that this was one of a interesting specification of UDP. In version 6, UDP checksum is …