3

I am trying to use the tcpdump command in a project and I have some difficulties understanding the help page.

SYNOPSIS
   tcpdump [ -AbdDefhgHIJKlLnNoOpPqRStuUvxX ] [ -B buffer_size ] [ -c
   count ]
           [ -C file_size ] [ -G rotate_seconds ] [ -F file ]
           [ -i interface ] [ -j tstamp_type ] [ -k (metadata_arg) ]
           [ -m module ] [ -M secret ]
           [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
           [ -W filecount ]
           [ -E spi@ipaddr algo:secret,...  ]
           [ -y datalinktype ] [ -z postrotate-command ] [ -Z user ]
           [ -Q packet-metadata-filter ]
           [ expression ]

First, what is this "[ -AbdDefhgHIJKlLnNoOpPqRStuUvxX ]" at the top ? What is the meaning of that ? I also see a lot of people on the internet doing crazy things with this command, for example tcpdmp -nnvvXSs 1514 ... what is that -nnvvXSs, and how can we know this can be used ?

I see codes examples that according to me does not correspond to the man page, I just don't get how to read, how to understand this help file.

Anybody tell me how to read this and understand it ?

migrated from cs.stackexchange.com Jul 7 '15 at 22:52

This question came from our site for students, researchers and practitioners of computer science.

  • Type 'man man' to learn how to read man pages. – johntait.org Nov 6 '15 at 16:23
2

By convention, the brackets indicate something that is optional. So you can run tcpdump, or tcpdump -c 3 -i eth0, or tcpdump -c 3 -r /path/to/file, etc. Also, unless explicitly indicated, options can be used in any order, so you can run tcp -i eth0 -c 3, etc.

Most commands allow options to be clustered when they use a single letter. For example, tcpdump -AX is equivalent to tcpdump -A -X. The manual groups all options that don't take arguments to make the presentation shorter: [ -Abd ] would be a shortcut for [ -A ] [ -b ] [ -d ], etc.

The synopsis is just a summary. Read the “description” or “options” section to see what each option does and what the word after each option can be replaced with.

For example, tcpdmp -nnvvXSs 1514 is a shorter equivalent of tcpdump -n -n -v -v -X -s -s 1514, and means:

  • -n: don't do name resolution. Repeating this option has no additional effect.
  • -v: causes tcpdump to print out more stuff. Repeating this option causes it to print even more stuff.
  • -X adds a dump of the content of each packet to the output.
  • -S causes absolute TCP sequence numbers to be printed.
  • -s 1514 causes only the first 1514 bytes of each packet to be captured.
1

you can check man pages by scroll down to get more details about options

root@ubuntu:~# man tcpdump

to search for any keyword type /keyword then enter

Below are most common options you can use with tcpdump .

  • -i any : Listen on all interfaces just to see if you’re seeing any traffic.

  • -i eth0 : Listen on the eth0 interface.

  • -D : Show the list of available interfaces

  • -n : Don’t resolve hostnames.

  • -nn : Don’t resolve hostnames or port names.
  • -q : Be less verbose (more quiet) with your output.
  • -X : Show the packet’s contents in both hex and ASCII.
  • -XX : Same as -X, but also shows the ethernet header.
  • -v, -vv, -vvv : Increase the amount of packet information you get back.
  • -c : Only get x number of packets and then stop. icmp : Only get ICMP packets.
  • -s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less.
  • -S : Print absolute sequence numbers.
  • -e : Get the ethernet header as well.
  • -q : Show less protocol information.
  • -E : Decrypt IPSEC traffic by providing an encryption key.

you can check online resources if you're newbie to Tcpdump fee Free to check below .

https://danielmiessler.com/study/tcpdump/

http://packetpushers.net/masterclass-tcpdump-expressions/

  • Thank you for your complete answer sameh Ammar. I know that I can scroll down and I have read a good part of these keywords, but I still can not understand how things like this : -nnvvXSs are possible. How can we know that we can gather keywords like that, and what is the meaning of such an expression ? – phenetas Jul 7 '15 at 23:11
  • you can use more than one flag to increase or decrease information you want from Tcpdump output . let's check this -nnvvXSs . -nn : Don’t resolve hostnames or port names. -X :Show the packet’s contents in both hex and ASCII. --s : Define the snaplength (size) of the capture in bytes. Use -s0 to get everything, unless you are intentionally capturing less. -S : Print absolute sequence numbers. so final should be : -nnvvXSs – sameh Ammar Jul 7 '15 at 23:21
1

Ok, I may start to understand. Tell me if I am right.

I tried this on my terminal sudo tcpdump -nnvvXeB 1024 host 10.11.204.15

So if I understand well, -nnvvXeB 1024 is the same that -nn -vv -X -e -B 1024 witch is the same that -B 1024 -nn -X -e -vv witch is the same that -B 1024 -nnXevv

Are they others "swapping" I can do with this command ?

In the man page there are different categories "NAME" "SYNOPSIS" "DESCRIPTION" "OPTIONS" "OUTPUT FORMAT" etc... If I understand right, the commands in "SYNOPSIS" are all command that need to be followed by arguments (for example -F need to be followed by a file name, -i by the name of an interface etc..), whereas things listed in "OPTIONS" are just single letters that can be added without argument.

Am I right ? Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.