2

I can do tcpdumps with this command: 

tcpdump -w `date +%F-%Hh-%Mm-%Ss-%N`.pcap src 10.10.10.10 or dst 10.10.10.10

Q: I have an FTP server with username: FTPUSER and password FTPPASSWORD. How can I upload the tcpdump in "real time" I mean I don't have a too big storage to store the dumps, so I need to upload it to a place what I can only reach via FTP. Can I "pipe" somehow the output of the tcpdump to an ftp client that uploads it? [I need to preserve the filenames too: "date +%F-%Hh-%Mm-%Ss-%N.pcap"]

so I'm searching for a solution that doesn't store any tcpdumps locally, rather it uploads the dumps in "real-time".

The OS is OpenWrt 10.03 - the router where the tcpdump runs. [4MB flash on the router, that's why I can't store them locally.]

UPDATE2: there is no SSH connection to the FTP server, just FTP [and FTPES, but that doesn't matter now I think]

|improve this question
  • I updated the question! – LanceBaynes Jan 3 '12 at 11:24
5

With SSH unavailable (and possibly no UNIX/Linux machine the FTP server runs on, you could use netcat otherwise, too), the following might work:

Using curl, you can upload from STDIN to a file via FTP this way:

tcpdump -w - | curl -u FTPUSER:FTPPASS ftp://ftpserver/where/ever/dump.pcap -T -

where tcpdump outputs raw packets (compare this question) and curl appends (overwrites? not sure) this input. I'm not completely sure if this works, but it might be worth a try.

(Timestamping the file curl creates is left as an exercise.)

|improve this answer
  • it's almost good, but it only does that it writes a file, only a few KBytes big, and then nothing [on the FTP server] – LanceBaynes Jan 3 '12 at 20:57
  • Hmm.. you could really try netcat. (There's a windows port, too, if that's what keeps you from using ssh.) – sr_ Jan 4 '12 at 11:29
  • I use linux on desktop. the problem is with ssh that there is no ssh SERVER. just FTP. – LanceBaynes Jan 6 '12 at 16:47
  • You do not even need to use curl, if ftp accepts auto-login enabled mode then you can use ~/.netrc file and put username/password in it and use ftp directly. – Nikhil Mulley Jan 6 '12 at 17:52
2

Take a look at the -C option to tcpdump:

   -C     Before  writing  a  raw  packet  to  a savefile, check whether 
 the file is currently larger than file_size and, if so, close the current 
 savefile and open a new one.  Savefiles after the  first savefile  will  have 
 the name specified with the -w flag, with a number after it, starting at 1 
 and continuing upward. The units of file_size are  millions  of  bytes 
 1,000,000  bytes, not 1,048,576 bytes).

If you set the size flag to something reasonably small and write a cron script that tests for the existence of new overflow files every minute or so, then uploads the overflowed files via FTP and changes the name before deleting them, you should get what you're looking for.

This setup would still be vulnerable to DOS if something floods the link faster than your cron script can upload the new files, and if you have any SSH capability at all I highly recommend the ssh pipeline trick @Chris Green offers up above.

|improve this answer
2

You can write the tcpdump output to a pipe and then save it elsewhere. I updated your BPF filter as well.

tcpdump -w - host 10.10.10.10  | ssh host2 'cat - > `date +%F-%Hh-%Mm-%Ss-%N`.pcap'

This will write the packets to stdout, then write it over an ssh connection to another host. You can also turn it around and run it from the other host.

ssh router tcpdump -w - host 10.10.10.10 > `date +%F-%Hh-%Mm-%Ss-%N`.pcap
|improve this answer
  • the "host" parameter in tcpdump is just like "src 10.10.10.10 or dst 10.10.10.10"? – LanceBaynes Jan 3 '12 at 12:08
  • no ssh please :P – LanceBaynes Jan 3 '12 at 20:58
1

install curlftpfs

opkg update; opkg install curlftpfs

then create a script that will run after every boot of the router

vi /etc/rc.d/S99tcpdump

the content of S99tcpdump

#!/bin/ash

mkdir -p /dev/shm/something
curlftpfs FTPUSERNAMEHERE:FTPPASSWORDHERE4@EXAMPLE.COM /dev/shm/something/
tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w "/dev/shm/something/tcpdump-`date +%F-%Hh-%Mm-%Ss`.pcap" &

make it executable

chmod +x /etc/rc.d/S99tcpdump

reboot router, enjoy.

p.s.: looks like "-s 0" is needed because there could be messages like: "packet size limited when capturing, etc." - when loading the .pcap files in wireshark

p.s.2: make sure the time is correct because if not, the output filename could be wrong..

|improve this answer
0

I think for ftp to work synchronously, it needs to be aware there is this file stream not from the disk but from the program; besides it could get very difficult to accomplish this.

I would suggest you go with sshfs and use ssh/sshfs to mount the remote filesystem with the proper credentials (it is a user land filesystem, so little configuration changes related to fuser on system would do, no super credentials required) then use tcpdump which would constantly dump the packet stream capture into file on the sshfs mounted filesystem.

Starters on SSHFS:

http://www.linuxjournal.com/article/8904

http://www.lylebackenroth.com/blog/sshfs/

|improve this answer
  • I updated the question because of you are mentioning ssh – LanceBaynes Jan 3 '12 at 11:53
  • no ssh please! :P – LanceBaynes Jan 3 '12 at 20:58
0

Use SMB / samba! your dd-wrt router supports it:
http://www.dd-wrt.com/wiki/index.php/Samba#Running_a_Samba_client_on_DD-WRT

Once you can ls and see a file in the directory you set up on your Windows box then just tell tcpdump to output to that directory:

tcpdump -n -i any -s 65535 src 192.168.2.200 and not dst port 139 -w /tmp/smbshare/capture.lpc

You don't want it monitoring traffic going over the SMB (server message block) port or it will monitor its own traffic and just explode the file size.

|improve this answer
  • 1
    better to use tcpdump -n -i any -s 65535 src net 192.168.0.0/16 and not port 139 and not port 1068 -w /tmp/smbshare/capture.lpc – David Levine Nov 14 '12 at 17:46
0

Another tiny way is to use netcat (built-in in busybox).

Router: tcpdump -w - | nc 192.168.1.110 1337

Host: nc -l -p 1337 > dump.pcap

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.