Capture filter filter with tcpdump/tshark

Question

I'd like to filter ip messages which are constructed as follow (see picture below):

1. GRE on top of IP
2. GRE contains IP with UDP on port 1234 (in the picture below port 80).

How can I filter such messages?

PS operating system is windows based

Answer 1

I'm not sure by what you mean with "on top" of GRE so I'll include both.

1. If you are trying to capture packets going to and from a GRE and you know the interface for the GRE tunnel you can do tcpdump -i GRE_INTERFACE host IP to show all traffic going to and from "IP", if you just want traffic going to it change host to dst. To get just UDP traffic on port 1234 tcpdump -i GRE_INTERFACE host IP and udp and port 1234

2. If you are trying to capture GRE packets themselves you can do tcpdump -i any proto gre, if you have too much GRE traffic and want to see it by the specific tunnel do tcpdump -i any proto gre and host IP_OF_GRE_TUNNEL_REMOTE

I hope this helps