3

What options should I run tcpdump with to have it just do a hex dump of packets without trying to interpret its contents? Running it astcpdump -e -v -x or similar attempts to interpret layers, however I don't want it.

I want what tshark does:

% sudo tshark -xxx -i eth0
...
  • The closest I can get as output format is tcpdump -w/dev/stdout | od -A x -t x1z and it is not the same thing, as it does not differentiates the packets. – Rui F Ribeiro Aug 10 '16 at 14:42
2

The closest two solutions I can find for this are these

  1. Postprocess to remove the decoding.

    tcpdump -nXX -i eth0 | sed $'s/^[^ \t].*//'
    

    This isn't perfect as the formats are a little different.

    tshark
    0000  52 54 00 12 35 02 08 00 27 0f db b3 08 00 45 00   RT..5...'.....E.
    0010  00 54 2a 4d 40 00 40 01 e9 43 0a 00 02 0f 0a 0f   .T*M@.@..C......
    0020  10 fb 08 00 ab 06 1e b5 00 01 00 3f ab 57 00 00   ...........?.W..
    
    tcpdump
    0x0000:  0008 9bbd ab8a 001d aadd cb68 0800 4500  ...........h..E.
    0x0010:  0028 3ec8 4000 7e06 a075 0a0a 0510 0a0f  .(>.@.~..u......
    0x0020:  046a cb6a 0016 7049 a307 5eaf 8afb 5010  .j.j..pI..^...P.
    
  2. Write to a data file and use tshark to interpret it (possibly on another machine).

    tcpdump -w /tmp/capture.dat -i eth0
    tshark -r /tmp/capture.dat -xxx
    

    Here, since we're using tshark to process the capture file, the output will be exactly as you want. You can do "nasty" things like running tshark remotely if necessary:

    ssh -zq remote_host tshark -r - -xxx < /tmp/capture.dat
    
  • For the first one, you may want to add -n, -q and -t to minimise the amount of information in the part you're going to remove anyway. – Stéphane Chazelas Aug 10 '16 at 15:00
  • @StéphaneChazelas maybe I've got a cut-down version of tcpdump (it's running on a QNAP). Mine only emits a single line per packet and appears to ignore (but recognise) -q, and -t. There's also no supporting man page for the specific implementation. – roaima Aug 10 '16 at 15:04
2

AFAICT tshark -xxx doesn't omit anything, it just adds a hexdump of the packet below the one-line interpretation of it.

So if you want the same thing, then I believe this is what you need:

tcpdump -xx

EDIT: or tcpdump -XX if you also want an ASCII dump like tshark does

If you truly want no interpretation at all, only a hex dump, then:

tcpdump -w - | hexdump

EDIT2: to clarify further - and following roaima's comment - my answer above is based on the nearest tshark I could find, which turns out to be version 1.8.10 and produces this output (I'm using -r instead of -i just to show the same packet in each example, I don't think this will matter):

$ tshark -r test.pcap
  1   0.000000 10.55.131.166 -> 10.48.37.151 TCP 78 58311 > https [SYN] Seq=0 Win=65535 Len=0 MSS=1260 WS=32 TSval=1072006161 TSecr=0 SACK_PERM=1

$ tshark -r test.pcap -xxx
  1   0.000000 10.55.131.166 -> 10.48.37.151 TCP 78 58311 > https [SYN] Seq=0 Win=65535 Len=0 MSS=1260 WS=32 TSval=1072006161 TSecr=0 SACK_PERM=1

0000  00 50 56 9e 18 78 00 07 4f 1c e8 00 08 00 45 00   .PV..x..O.....E.
0010  00 40 7b 8b 40 00 36 06 0b 89 0a 37 83 a6 0a 30   .@{.@.6....7...0
0020  25 97 e3 c7 01 bb 77 13 bc 5e 00 00 00 00 b0 02   %.....w..^......
0030  ff ff 9d 35 00 00 02 04 04 ec 01 03 03 05 01 01   ...5............
0040  08 0a 3f e5 84 11 00 00 00 00 04 02 00 00         ..?...........

and then this was my suggestion for tcpdump (with -n added to also disable DNS lookups, I had not initially noticed that difference):

$ tcpdump -r test.pcap -XX -n
reading from file test.pcap, link-type EN10MB (Ethernet)
17:21:13.507110 IP 10.55.131.166.58311 > 10.48.37.151.https: Flags [S], seq 1997782110, win 65535, options [mss 1260,nop,wscale 5,nop,nop,TS val 1072006161 ecr 0,sackOK,eol], length 0
    0x0000:  0050 569e 1878 0007 4f1c e800 0800 4500  .PV..x..O.....E.
    0x0010:  0040 7b8b 4000 3606 0b89 0a37 83a6 0a30  .@{.@.6....7...0
    0x0020:  2597 e3c7 01bb 7713 bc5e 0000 0000 b002  %.....w..^......
    0x0030:  ffff 9d35 0000 0204 04ec 0103 0305 0101  ...5............
    0x0040:  080a 3fe5 8411 0000 0000 0402 0000       ..?...........
  • With the version of tshark that I've got, tshark -xxx produces one hex dump per packet, each packet separated from the next by a blank line. Hex dump offsets reset from zero for each packet. There is no decoding at all. – roaima Aug 10 '16 at 15:01
  • 1
    @roaima: interesting, so apparently tshark behaviour is not consistent across versions. – hertitu Aug 10 '16 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.