a command line packet analyzer
1
vote
2answers
3k views
How to gather DNS A record requests?
I need to record all outgoing A records on a RedHat PC. I tried using tcpdump:
tcpdumpdns=OUTPUT-FILENAME-HERE
nohup tcpdump -K dst port 53 -w $tcpdumpdns > /dev/null 2>&1 &
It makes ...
3
votes
1answer
112 views
Tell tcpdump to skip custom header
I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers ...
1
vote
1answer
77 views
Sniffing VirtualBox machine behind NAT
I have a VirtualBox machine with a single interface connected to VB's NAT mode. What I would like to do is sniff all traffic coming from/to any machine behind that NAT. (I don't think I will need to ...
-1
votes
1answer
92 views
tcpdump host filter doesn't work
I'm using tcpdump on a linux ARM computer (Raspberry Pi). The command tcpdump host "ip" -v gives nothing when I go on the website "ip" with my laptop, but if I try tcpdump port 80 -v it works ...
2
votes
4answers
626 views
How to capture images transferred via HTTP?
I have multiple browsers and I want save all images with size more than 30KB and save to specified address.
What is best way?
listen to tcpdump and read the content, and then save to a file, or
use ...
1
vote
0answers
122 views
Packets not received by TUN device
I created a TUN device(nat64) and created a route so that all the required packets are forwarded to the TUN device from an eth device. But, I see that many packets are not received by the TUN device.
...
1
vote
1answer
294 views
Tcpdump: how to capture outgoing packets on a virtual interface?
On a Linux system that I am testing now, it has a couple of virtual L2 devices chained together to add/manipulate our own frame headers which are encaped between Eth header and IP header.
now this ...
4
votes
1answer
129 views
What does this tcpdump line means?
Reading the manpage of tcpdump I found this example
tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'
but I don't understand it, especially the last part.
The ...
0
votes
1answer
87 views
Filesystem writes seemingly lost
I've been experimenting with tcpdump, and I've found some very bizarre filesystem behavior. It doesn't look to be a tcpdump problem as I'll explain in a second.
The following command produces no ...
1
vote
1answer
335 views
tcpdump and https
Why following command doesnt grab the packets to faceebook site
sudo tcpdump host facebook.com and dst port 443
but next grabs
sudo tcpdump host java.com
1
vote
1answer
173 views
How to log all domains accessed?
Maybe I could use tcpdump, filter out all non-HTTP packets to reduce disk consumption, and then parse the output looking for domain names. Maybe there is a better solution. Do you know one?
2
votes
0answers
94 views
router latency measured by tcpdump increases
I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
4
votes
1answer
896 views
How can I run tcpdump from a Python script without AppArmor complaining?
For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just ...
2
votes
1answer
3k views
tcpdump: “packets captured” vs “packets received by filter”
We have a script which calls
tcpdump -v src host <IP address> and port <port number> >>out.txt 2>>err.txt -w capture.cap
on multiple IP-s while the other parts of the script ...
3
votes
1answer
179 views
sandbox tcpdump under OpenBSD?
From FreeBSD 9.0 tcpdump is sandboxed with Capsicum. Are there any solutions for sandboxing tcpdump under OpenBSD? Just want to secure a running:
tcpdump -w output.pcap
because it can be only used ...
1
vote
3answers
438 views
using “-vvv” with “-w FILENAME” with tcpdump makes better output?
Does it makes a more detailed output if I use
tcpdump -vvv -w FILENAME
vs. if I use:
tcpdump -w FILENAME
or it doesn't makes any sense if I use the "-vvv" when I'm using "-w FILENAME"?
4
votes
1answer
360 views
How to recover a file from a tcpdump?
I use
tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w output.pcap
to monitor for ex.: my HTTP traffic.
I upload a .zip file through HTTP.
How can I retrieve the .zip file from the ...
3
votes
1answer
815 views
Count in real time the output lines from another output command
I think what I want to do is very easy, but I can not find a way to do that:
If I put this command:
[root@:Active] tmp # tcpdump -i any -s 65535 host 192.168.1.110 and port 1645 or port 1813 -v
-X | ...
2
votes
1answer
752 views
iptrace for linux: how can I trace full packet contents?
I normally use iptrace on our AIX servers to get packet traces but have recently found out that this doesn't work for other 'nix systems - namely Centos.
Does anyone know what the analog would be?
...
2
votes
1answer
450 views
How to read a hexdump byte by byte in bash or awk?
This is the hexadecimal output of an IPv6 TCP packet captured with tcpdump:
6000 0000 0018 0620 0000 0000
0000 0000 0000 0000 0000 0001 0000 0000
0000 0000 0000 0000 0000 0002 *0026 0026
0000 ...
8
votes
1answer
522 views
what level of the network stack does tcpdump get its info from?
As I was trying in vain to fix a faulty ethernet controller here, one thing I tried was running tcpdump on the machine.
I found it interesting that tcpdump was able to detect that some of the ICMP ...
1
vote
2answers
933 views
How to modify the output of tcpdump to be human-readable?
I have a tcpdump command:
tcpdump -i wlan0 dst port 80 and ! dst 192.168.1.201 and ! src 192.168.1.201 -vvv -s0 -w proba.txt
Which gives the following output:
root@SERVER:/tmp# egrep "GET|Host:" ...
7
votes
1answer
3k views
Buffer size for capturing packets in kernel space?
Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if:
that size is configurable and/or
where can I see the size for my distro?
From ...
2
votes
1answer
192 views
How to know the number of messages received in a message queue at a point of time
I have a implementation where the hardware dispatches 300 packets every second to a host application through DMA transfer and then to the host application's message queue.
When packets are sent at ...
2
votes
1answer
518 views
Is it possible to capture all network traffic using tcpdump?
I have 3 computers on the same sub-net. Computer A and B are communicating with each other (ping, telnet, etc.). I'd like to see the packets between A and B on computer C. Is it possible to do this ...
5
votes
3answers
3k views
How to process/pipe TCPDUMPs output in realtime
If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I
root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1
tcpdump: verbose output suppressed, use -v or ...
0
votes
2answers
565 views
Understanding tcpdump output on a linux router
My router has an atm0 interface and a VLAN (atm0.1) interface, atm0.1 has the WAN IP address.
When using tcpdump -i atm0, the packets captured are only outgoing packet (LAN to WAN).
05:34:19.504895 ...
