21

I am trying to HTTP traffic to port 8007 in a file and then view them later.

# tcpdump -i eth0 -s0 -n -w /tmp/capture port 8007 &
# tcpdump -r /tmp/capture -A | grep '10.2.1.50'

I expected to see packet data in ASCII but that does not happen. What I get instead is something like:

23:03:16.819935 IP 10.2.1.50.8007 > 10.2.1.120.57469: . ack 1369 win 272 <nop,nop,timestamp 188139705 215355175>
23:03:16.819943 IP 10.2.1.120.57469 > 10.2.1.50.8007: P 1369:1592(223) ack 1 win 12 <nop,nop,timestamp 215355175 188139703>
23:03:16.819947 IP 10.2.1.50.8007 > 10.2.1.120.57469: . ack 1592 win 272 <nop,nop,timestamp 188139705 215355175>
23:03:17.029587 IP 10.2.1.50.8007 > 10.2.1.120.57469: P 1:780(779) ack 1592 win 272 <nop,nop,timestamp 188139758 215355175>
23:03:17.029736 IP 10.2.1.50.8007 > 10.2.1.153.49989: F 822:822(0) ack 3494 win 272 <nop,nop,timestamp 188139758 1641992210>
23:03:17.040759 IP 10.2.1.120.57469 > 10.2.1.50.8007: . ack 780 win 15 <nop,nop,timestamp 215355396 188139758>
23:03:17.079305 IP 10.2.1.153.49989 > 10.2.1.50.8007: . ack 823 win 15 <nop,nop,timestamp 1642053303 188139758>

How do I fix the write or read to see the actual content? I have tried other options such as -v but that's not for content. I am using SLES 11 SP2. Is tcpdump the right tool for this?

Thanks a lot.

--EDIT

# tcpdump --version
tcpdump version 3.9.8
libpcap version 0.9-PRE-CVS

I also tried with -X option but still do not see the payload data.

2
  • 2
    ..That is the actual contents? Dec 1, 2014 at 23:45
  • @DisplayName thanks!! I was doing a grep on host IP addresses and missing the real thing. Fixed that in tcpdump filter expression. How do I mark this solved?
    – Dinesh
    Dec 1, 2014 at 23:48

4 Answers 4

22

You are able to just see the header and not packet contents because you piped the output to grep. So it is just getting the lines in which the IP address is present.

-A option to tcpdump gives the packet contents as well.

2
  • 2
    from the question: # tcpdump -r /tmp/capture -A | grep '10.2.1.50'
    – Jeff Schaller
    Apr 7, 2018 at 12:29
  • 3
    I am saying if you remove the | grep '10.2.1.50' part of your command, you will be able to see all the packet contents as well. If you want to search for the contents of the packets with that IP, then ask grep to print out the subsequent lines of the lines in which the IP is present. Apr 8, 2018 at 7:51
8

Use tcpdump -X

For example (works on the Fedora/Centos that I use):

sudo tcpdump -nvvvXi br0 

    13:29:20.311228 00:1c:73:86:12:f9 > 01:00:5e:00:01:81, ethertype IPv4 (0x0800), length 86: (tos 0x0, ttl 5, id 0, offset 0, flags [none], proto UDP (17), length 72)
        10.134.245.1.ptp-general > 224.0.1.129.ptp-general: Ptp MessageType: Follow_Up, SequenceId: 8208
    
            0x0000:  4500 0048 0000 0000 0511 d49c 0a86 f501  E..H............
            0x0010:  e000 0181 0140 0140 0034 0cd0 0802 002c  .....@.@.4.....,
            0x0020:  0100 0000 0000 0000 0000 0000 0000 0000  ................
            0x0030:  444c a8ff ffc7 1f6b 0236 2010 0200 0000  DL.....k.6......
            0x0040:  5f2a b430 0d5e b480                      _*.0.^..
2
  • The OP said "I also tried with -X option but still do not see the payload data." so perhaps there's a version difference that brought about a change?
    – Jeff Schaller
    Aug 5, 2020 at 14:13
  • 2
    This is the actual answer!
    – ranu
    Feb 5, 2021 at 17:44
3

That is the contents. You have probably used some command to filter out content.

-1

you can use Wireshark tool for best results.

2
  • 9
    Perhaps you could show an example of how to start wireshark to achieve what the OP tried to do with tcpdump.
    – AdminBee
    Aug 5, 2020 at 15:09
  • I tried Wireshark, however it did not work.
    – Madeo
    Dec 15, 2020 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.