using “-vvv” with “-w FILENAME” with tcpdump makes better output?

Question

Does it makes a more detailed output if I use

tcpdump -vvv -w FILENAME

vs. if I use:

tcpdump -w FILENAME

or it doesn't makes any sense if I use the "-vvv" when I'm using "-w FILENAME"?

Answer 1

No, I don't think so, from the manpage:

   -w     Write the raw packets to file rather than parsing  and  printing
          them  out.  They can later be printed with the -r option.  Stan‐
          dard output is used if file is ``-''.

-- note "raw packets" --

   -v     When  parsing and printing, produce (slightly more) verbose out‐
          put.  [...]
          When writing to a file with the -w option, report, every 10 sec‐
          onds, the number of packets captured.

So what would make sense is using tcpdump -vvv -r FILENAME to parse and print what was written to FILENAME -- the raw packets.

Answer 2

No.

Once you're choosing -w FILENAME it saves the raw data packets as they come through the link. There literally isn't more detail it can save to file. -vvv is only relevant when you're displaying it for human review... And in almost all of the cases where you want humans to read the output, I recommend you use Wireshark.

Answer 3

The only flag I'm aware of that affects how much detail you get in -w mode is -s.

Historically, tcpdump was built to capture only 68 bytes per packet by default, in order to reduce the I/O load on the system. If you're snooping a web connection, this is enough to get the Ethernet, IP and TCP headers, but probably little to none of the HTTP headers.

If your tcpdump was built this way, passing a bigger "snaplen" with -s may work fine, or it may overload your system. It depends on how fast your CPU, disk and network connection are, and on how much data per second you are asking tcpdump to capture and write to disk.

For Ethernet, -s 1514 should capture whole packets in typical configurations. Alternatively you can use -s 0 to capture the whole packet regardless of size, which may be useful if VLANs or Jumbo frames are in use.

If you load a capture file into Wireshark (or similar) and you see more detail when passing -s bignum, now you know why. If nothing changes, your tcpdump was probably built to capture full packets.