Getting wireshark to format OSC messages

[mrreason]

I like to use this top for my osc/wireshark question, if that is ok.

My wireshark does not recognize my udp packets as osc packets. When I select an osc packet and want to set "Decode as", I can only select for tcp ports that it should decode the packets over the specific port (say 57120) as osc. For upd packets (and this is sent by Tidal), I can't choose to decode it as osc packets.

In general I see the packets (even if a bit cryptic):

I am using Wireshark 3.2.5 (current stable release) on macOS 10.15.5

[ben]

I've never been able to figure out how to get Wireshark to work (and tried a few times) so thanks for posting here.

[yaxu]

Yes @lwlsn was having problems with this too. I'm using wireshark 2.6.10 from linux mint and it works fine.

[yaxu]

Maybe it needs to be enabled @mrreason ? https://www.wireshark.org/docs/wsug_html/#ChAdvEnabledProtocols

[yaxu]

(Decided best to move to a new topic as it was a bit different from the print values to console one)

[mrreason]

Thank you very much, this was the problem!

As you can see, osc_udp is disabled by default. After I enabled it, it works!

Now I can do fancy stuff like filtering and color marking (e.g. to distinguish between different ports)

[yaxu]

Great! OSC is generally sent over UDP, so that's a strange thing to be off by default..

[loopology]

For the record, on the command line you can use tshark:

tshark -i lo0 -Y osc -V

• -i lo0: selects loopback interface
• -Y osc: selects OSC messages
• -V: outputs detailed content of OSC message

[yaxu]

Oh nice! To only get event triggers you can do

tshark -i lo -Y 'osc.message.header.path=="/dirt/play"' -V

[jwaldmann]

that's a very good way to see what actually happens.

For documentation, the output looks like this:

Open Sound Control Encoding
    Bundle
        Timetag: Mar  7, 2023 14:19:57.894551277 UTC
        Size: 112 bytes
        Message: /dirt/play ,sssfsfsfsfsiss
            Header
                Path: /dirt/play
                Format: ,sssfsfsfsfsiss
            String: _id_
            String: 1
            String: cps
            Float: 0.5625
            String: cycle
            Float: 878
            String: delta
            Float: 0.888888
            String: note
            Float: 0
            String: orbit
            Int32: 0
            String: s
            String: superpiano

I had to enable osc_udp in the wireshark GUI (as described above) then tshark works (as described).

[yaxu]

Aha, digging a bit further, it looks like you can specify that on the commandline too:

tshark --enable-heuristic osc_udp -i lo -Y 'osc.message.header.path=="/dirt/play"' -V

(I put sudo in front of that too, to avoid having to configure security settings properly..)

[jwaldmann]

@yaxu

configure security settings properly..)

on Fedora GNU/Linux, apparently that's handled via a special group

$ tshark
...
tshark: Couldn't run /usr/bin/dumpcap in child process: Permission denied
Are you a member of the 'wireshark' group? Try running
'usermod -a -G wireshark _your_username_' as root.