2

I normally use iptrace on our AIX servers to get packet traces but have recently found out that this doesn't work for other 'nix systems - namely Centos.

Does anyone know what the analog would be?

I've tried the following, but none seem to work as I expect:

697  sudo /usr/sbin/tcpdump -w test.pcap -i eth0
1010  sudo /usr/sbin/tcpdump port 80
1012  sudo /usr/sbin/tcpdump port 80 -i eth0
1015  sudo /usr/sbin/tcpdump -A port 80 -i eth0
1017  sudo /usr/sbin/tcpdump -w ~/capture.pcap port 80 -i eth0

I can see the header data in wireshark, but I can't seem to see the actual packet data.

4

The saved portion of each captured packet is defined by the snaplen option. In some distributions, the default snaplen is set to around 68 bytes. The packets are then truncated to 68 bytes, hiding some of the payload. You can save the complete packets by setting the snaplen to 0 (i.e. maximum) as follows: tcpdump -s0 -w test.pcap -i eth0

  • Ug, thank you! That was not obvious to me :) – javamonkey79 Nov 28 '11 at 22:00
  • @javamonkey79 what about wireshark, is it the same as tcpdump ? – Hanan N. Nov 29 '11 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.