Here's a handy way of logging all UDP packets which start with a specific byte prefix:
TCP Dumpโ
sudo tcpdump -X -v 'udp[8:4] = 0x03050b11'
TSharkโ
sudo tshark -V -f 'udp and udp[8:4] = 0x03050b11'
Wireshark UIโ
You can paste this into the 'Display Filter' input:
udp contains 03:05:0b:11
