Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I normally use iptrace on our AIX servers to get packet traces but have recently found out that this doesn't work for other 'nix systems - namely Centos.

Does anyone know what the analog would be?

I've tried the following, but none seem to work as I expect:

697  sudo /usr/sbin/tcpdump -w test.pcap -i eth0
1010  sudo /usr/sbin/tcpdump port 80
1012  sudo /usr/sbin/tcpdump port 80 -i eth0
1015  sudo /usr/sbin/tcpdump -A port 80 -i eth0
1017  sudo /usr/sbin/tcpdump -w ~/capture.pcap port 80 -i eth0

I can see the header data in wireshark, but I can't seem to see the actual packet data.

share|improve this question
up vote 4 down vote accepted

The saved portion of each captured packet is defined by the snaplen option. In some distributions, the default snaplen is set to around 68 bytes. The packets are then truncated to 68 bytes, hiding some of the payload. You can save the complete packets by setting the snaplen to 0 (i.e. maximum) as follows: tcpdump -s0 -w test.pcap -i eth0

share|improve this answer
Ug, thank you! That was not obvious to me :) – javamonkey79 Nov 28 '11 at 22:00
@javamonkey79 what about wireshark, is it the same as tcpdump ? – Hanan N. Nov 29 '11 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.