Snoop output: how to display readable packet data on one single line

You can't rely on UDP to deliver packets in order because the specification doesn't provide those guarantees. Even assuming the most ideal situation, a single piece of ethernet cable between two hosts, there is still the matter of the OS, the network stack, the NIC driver, and the libc implementation that your writing against.

At every step in that chain, the writers of that code will have chosen NOT to prioritise ordering UDP packets even if they arrive in order for the simple reason that they don't have to.

One contrived example could be the data structure that incoming packets are read into, which might be a ring buffer. Packets arriving in order, will be placed, in order into the ring buffer, but it may be simpler for the driver writer to dump them to the upper layers of the networking code in memory order, hence randomising their ordering.

Taking your situation, a virtual machine run on a shared infrastructure that will be run for volume, not performance, then the probability of predicting the order UDP packets will be received will be low.

In short, if the spec says you can't rely on UDP packet ordering. You can't rely on it, and you can't try to tweak the environment to give a stronger guarantee than the spec ever promised.

My first choose would be wireshark. If you must do it from a terminal you can also try ngrep, it gives a more readable output than tcpdump. You can probably filter out the header info with a simple bash script.

http://ngrep.sourceforge.net/usage.html#http