a command line packet analyzer

learn more… | top users | synonyms

3
votes
1answer
223 views

sandbox tcpdump under OpenBSD?

From FreeBSD 9.0 tcpdump is sandboxed with Capsicum. Are there any solutions for sandboxing tcpdump under OpenBSD? Just want to secure a running: tcpdump -w output.pcap because it can be only used ...
4
votes
1answer
824 views

How to recover a file from a tcpdump?

I use tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w output.pcap to monitor for ex.: my HTTP traffic. I upload a .zip file through HTTP. How can I retrieve the .zip file from the ...
1
vote
3answers
859 views

using “-vvv” with “-w FILENAME” with tcpdump makes better output?

Does it makes a more detailed output if I use tcpdump -vvv -w FILENAME vs. if I use: tcpdump -w FILENAME or it doesn't makes any sense if I use the "-vvv" when I'm using "-w FILENAME"?
3
votes
1answer
2k views

Count in real time the output lines from another output command

I think what I want to do is very easy, but I can not find a way to do that: If I put this command: [root@:Active] tmp # tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v -X | ...
2
votes
2answers
11k views

How to gather DNS A record requests?

I need to record all outgoing A records on a RedHat PC. I tried using tcpdump: tcpdumpdns=OUTPUT-FILENAME-HERE nohup tcpdump -K dst port 53 -w $tcpdumpdns > /dev/null 2>&1 & It makes ...
2
votes
1answer
2k views

iptrace for linux: how can I trace full packet contents?

I normally use iptrace on our AIX servers to get packet traces but have recently found out that this doesn't work for other 'nix systems - namely Centos. Does anyone know what the analog would be? ...
2
votes
1answer
634 views

How to read a hexdump byte by byte in bash or awk?

This is the hexadecimal output of an IPv6 TCP packet captured with tcpdump: 6000 0000 0018 0620 0000 0000 0000 0000 0000 0000 0000 0001 0000 0000 0000 0000 0000 0000 0000 0002 *0026 0026 0000 ...
9
votes
1answer
1k views

what level of the network stack does tcpdump get its info from?

As I was trying in vain to fix a faulty ethernet controller here, one thing I tried was running tcpdump on the machine. I found it interesting that tcpdump was able to detect that some of the ICMP ...
1
vote
2answers
2k views

How to modify the output of tcpdump to be human-readable?

I have a tcpdump command: tcpdump -i wlan0 dst port 80 and ! dst 192.168.1.201 and ! src 192.168.1.201 -vvv -s0 -w proba.txt Which gives the following output: root@SERVER:/tmp# egrep "GET|Host:" ...
4
votes
1answer
1k views

How can I run tcpdump from a Python script without AppArmor complaining?

For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just ...
2
votes
1answer
532 views

How to know the number of messages received in a message queue at a point of time

I have a implementation where the hardware dispatches 300 packets every second to a host application through DMA transfer and then to the host application's message queue. When packets are sent at ...
9
votes
1answer
6k views

Buffer size for capturing packets in kernel space?

Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if: that size is configurable and/or where can I see the size for my distro? From ...
3
votes
1answer
1k views

Is it possible to capture all network traffic using tcpdump?

I have 3 computers on the same sub-net. Computer A and B are communicating with each other (ping, telnet, etc.). I'd like to see the packets between A and B on computer C. Is it possible to do this ...
8
votes
3answers
8k views

How to process/pipe TCPDUMPs output in realtime

If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1 tcpdump: verbose output suppressed, use -v or ...
0
votes
2answers
798 views

Understanding tcpdump output on a linux router

My router has an atm0 interface and a VLAN (atm0.1) interface, atm0.1 has the WAN IP address. When using tcpdump -i atm0, the packets captured are only outgoing packet (LAN to WAN). 05:34:19.504895 ...