1

Sometimes I have to use tcpdump to troubleshoot problems with networking protocols that tcpdump does not know how to parse.

Is there a utility that could read tcpdump packets in hex dump format and then parse them according to structure I specified for this utility?

Something like:

tcpdump -nxi any udp | the_utility "Packet_id:%d@60"

for each packet would print:

Packet_id:1
Packet_id:2
Packet_id:4
Packet_id:3

The idea is that at offset 60 there is 32 bit integer that I want to be printed in decimal format to STDOUT.

I understand that IP fragmentation and TCP reassembly would require to pass along some state to the next hex dump for it to be properly interpreted. Let's assume this is not a problem for me. Nevertheless if you know of an elegant solution that could solve this, then that would be great.

While I like Wireshark, I don't always have an option to copy packet capture files to my workstation for offline inspection. Also, these are production appliances where I have to run tcpdump - this means that I need a solution where I would not have to install anything extra.

  • Wireshark is available on some Linux distros (or more exactly repositories), at least CentOS (I presume other RedHat also) and Debian. If the interactive/GUI features aren't wanted, it includes a commandline form tshark. – dave_thompson_085 Mar 23 '16 at 10:47
  • @dave_thompson_085 Unfortunately, I can't install wireshark, because the hosts don't have graphical interface, they sometimes don't even belong to me and sometime they are appliances where yum and apt-get is not connected to official Linux distros. – john1234 Mar 23 '16 at 16:10
  • So, if there were such a utility, you could install it on the machines in question, but you couldn't install Wireshark on the machines in question - not even the non-GUI parts of Wireshark (most of the code isn't GUI code, and there's tshark, which is a command-line packet capture and analysis program using the same dissectors that Wireshark uses)? – user44841 Mar 23 '16 at 17:06
  • @GuyHarris To be more specific - the appliances where I want to run tcpdump are based on standard ubuntu, but with stripped /etc/apt/sources.list file. I was hoping that such "utility" would exist on standard Ubuntu distribution already pre-installed and I would not have to install anything extra. For example there is hd, xdd and similar utilities, but they don't work quite well when piping from tcpdump. – john1234 Mar 23 '16 at 18:43
  • Is perl or python an option? perl has a Net::Pcap module which can be used to write custom packet-capture scripts, and python has the pcapy library. And there's always C and the pcap library. and even without those libraries, you can pipe tcpdump -x's output into perl or awk or even python and process it there to get the output you want. depending on exactly what you want to do you could probably hack something up with just tcpdump, grep, and sed. i.e. there is no tool to do exactly what you want, you'll have to write something yourself. – cas Mar 24 '16 at 0:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.