Export raw packet bytes in tshark, tcpdump, or similar?
<p><strong>Context:</strong></p>

<p>I have a *.pcap file with many WLAN probe requests. My goal is to extract the WLAN management frame of each probe request as raw bytes (that is, no headers and no extra information - only the raw bytes like they were originally captured).</p>

<p>In Wireshark, I can simply right-click the management frame and select "Export Packet Bytes...":
<a href="https://i.stack.imgur.com/SzrsP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/SzrsP.png" alt="Wireshark Raw Packet Byte Extraction"></a></p>

<p>If I select "RAW" as the file format, Wireshark gives me exactly what I want: A file containing nothing more than the selected bytes.</p>

<p><strong>Problem:</strong></p>

<p>I need to automate this task programatically. I came across tools like <code>tshark</code>, <code>tcpdump</code>, <code>capedit</code>, etc. However, none of these tools seem to allow me to extract the WLAN management frame and nothing more.</p>

<p>While I was able to get the desired bytes as ASCII on stdout using <code>tcpdump</code>, I wasn't able to save them to a file or into a variable. Additionally, I was only able to do it for a single probe request, not for all probe requests in the *.pcap file.</p>

<p><strong>Current Approach:</strong></p>

<p>As mentioned above, I was able to get the desired bytes as ASCII on stdout:</p>

<pre><code>$ tcpdump -r capture.pcap -c 1 -x
reading from file capture.pcap, link-type IEEE802_11_RADIO (802.11 plus radiotap header)
11:24:52.933799 1.0 Mb/s 2457 MHz 11b -77dBm signal antenna 1 Probe Request () [1.0* 2.0* 5.5* 6.0 9.0 11.0* 12.0 18.0 Mbit]
    0x0000:  0000 0108 8284 8b0c 1296 1824 3204 3048
    0x0010:  606c 2d1a ac01 02ff ff00 0000 0000 0000
    0x0020:  0000 0000 0000 0000 0000 0000 0000
</code></pre>

<p>To extract the raw bytes, I can simply pipe this output into <code>grep</code>, <code>sed</code>, and <code>xxd</code>:</p>

<pre><code>$ tcpdump -r capture.pcap -c 1 -x | grep "0x00" | sed  's/0x[[:xdigit:]]*:[[:space:]]*//g' | xxd -r -p &gt; rawbytefile
</code></pre>

<p>Obviously, this is a rather hacky way of accomplishing what I want and there must be a better way. Nobody wants code that's highly dependent on the human-centric output of other people's programs.</p>

<p><strong>Questions:</strong></p>

<ol>
<li>How can I extract the WLAN management frame in a proper way? (On the command line/programatically - using Bash, Python, etc.)</li>
<li>How can this be done for every probe request within the *.pcap-file? (Again, in a proper way - building another hacky loop by parsing ASCII output is not really what one should do...)</li>
</ol>