7

What is the command syntax to log all tcp connection packets?

I am trying to see what address and ports my computer is trying to connect to outgoing so that I may config my firewall.

9

For this use case I would suggest capturing only the packets attempting to initiate connections rather than all traffic. That would be anything with only the SYN flag set.

tcpdump -ni ${INTERFACE} -w ~/synconnections.pcap tcp[13] == 2 and src host ${MYIP}

I cribbed this mostly from the tcpdump man page. The section labelled "Capturing TCP packets with particular flag combinations (SYN-ACK, URG-ACK, etc.)" goes into detail what the flags mean (13th octet set to a value of 2 is a SYN).

Also, I am not sure what packet filtering solution you're using but you should look into whether or not it has a logging facility. Default deny all then allow http/https/ssh and check the logs to see what else is being blocked.

  • Im furious with my logging situation. I am using PF as my fire wall as its standard with OSX but it does not log or have logs turned on the way that BSD does and I can not figure out what it is doing. This is why I am even looking into tcpdump = / – Arcabard Nov 18 '13 at 19:43
  • thank you for using the filter tcp[13] == 2 that is much more informative then simply setting the flag. – Arcabard Nov 21 '13 at 17:37
4

If by log the outgoing TCP packets you mean write them to disk in the PCAP format you can use the following command:

$ tcpdump -nni eth0 -w outgoing-tcp.pcap ip src 192.168.1.1 and tcp

Replace the interface with your machine's interface and the IP address with your machine's IP address. Depending on the version of tcpdump you're using, like an older one, if you want to record the entire packet instead of truncating it like 96 bytes you can add the ``-s 0'' option which sets the snaplength to not truncate the packet. Though, on recent tcpdump versions you probably don't need these as it defaults to 65535 on most, if not all, platforms.

  • 65535 is padded , just curiosity. Thank you at least I can know something is happening. – Arcabard Nov 18 '13 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.