Seems that tcpdump is the best, if not the only answer here. It looks perfect for this job. Since, I'm using very limited version of Linux on my NAS, it wasn't there. But simple call to ipkg install tcpdump
solved the problem (hopefully I've installed Optware before, as it was also missing).
For this particular problem (listening for UDP packets on ports 3333 or 7777) command to execute is:
tcpdump -i eth0 -n udp port \( 3333 or 7777 \)
where -i
tells tcpdump to listen only on eth0
interface only (execute tcpdump -D
to see all adapters available to tcpdump on particular machine) and -n
forces tcpdump to not translate source addresses of intercepted packets and to display them as pure IPs.
To test, if my localizer isn't changing ports used, I could call:
tcpdump -i eth0 -n udp
which cause it to listen for anything (any port) in UDP protocol.
An alternative of:
tcpdump -i eth0 -n port \( 3333 or 7777 \)
will cause tcpdump to intercept any traffic on port 3333 or 7777, no matter, which protocol is used.
Running tcpdump
with only interface parameter:
tcpdump -i eth0
or even calling it without any parameters will capture all the traffic comming to machine that runs tcpdump
. However, this is useful, if you have physical access to it and can run program manually. If you have remote only access and must run tcpdump
via SSH, you might not be that lucky. SSH itself sents so many packets, that even with all other services down, you probably won't be unable to see anything in this "packets noise".
This could be partially solved, if you know source IP address (i.e. remote address of the machine, which will be sending traffic you want to capture). With this, you can limit tcpdump
like that:
tcpdump -i eth0 -n src 77.233.177.237
This is one-way listener that will capture all the traffic that is comming from that IP to your machine.
Alternative version:
tcpdump -i eth0 -n dst 77.233.177.237
lets you check all the "answers" that are sent from your machine to specified IP address.
Finally, executing this commad:
tcpdump -i eth0 -n host 77.253.175.217
will show you all the traffic that is being exchanged between computer, where you run tcpdump
and mentioned IP, which in this form is threated as both source and destination, so you see both "questions" and "answers".
You can also use tcpdump
on your machine to listen traffic exchanged between two other machines, connected to the same network. Since this is too off-topic and is using program as a really sniffer, maybe to do some bad things, I won't give you correct command to execute. Refer to sources I used or search the Internet.
Sources:
- http://www.softpanorama.org/Net/Sniffers/tcpdump.shtml
- http://linux.byexamples.com/archives/283/simple-usage-of-tcpdump/
- http://kmaiti.blogspot.com/2011/01/hot-to-use-tcpdump-command-to-capture.html
- http://openmaniak.com/tcpdump.php
- http://danielmiessler.com/study/tcpdump/