When I used editcap to extract a HTTP/2 Frame from a Captured PCAP using tcpdump, the HTTP/2 headers don't show up in extracted frame, but the Hex dump matches.
I am using the below editcap command to extract a frame from a fully captured PCAP.
editcap -F pcap -r nudr.pcap extract.pcap 41
The frame contains HTTP2 Headers, and the headers list shows up in the original PCAP, but after using editcap, only Header Block Fragment(hex dump) is shown and headers are not. The Hex Dump of frame matches in both the PCAPs.
Attaching below Screenshots 1st(Orignal PCAP) shows with Header and 2nd(Extracted PCAP) one only with Hex Dump: Orignal PCAP with Headers
