I'm on Ubuntu 18.04. I'm debugging an application that communicates with a remote server and I'd like to be able to directly view the bytes sent from my machine (rather than relying on debug output). Is there a way to do this?


View traffic that was already sent from your box? Not possible. You could infer the traffic based on what logs you have at the server side(if you have access to that server, but you will view the "Application Layer")

You could launch tcpdump before starting a connection to have all that traffic logged to a file. Example:

tcpdump -i eth0 -w /tmp/tcpdump.pcap host IP.OF.THE.SERVER

With the keyword host, tcpdump will filter to save only traffic that has the server you are connecting to as source or destination. This will avoid creating big files with all traffic of your network. -i stands for network interface and it requires a valid network interface and -w stands for "write raw packets to file" and it will require a valid path with write permissions.

This will create a .pcap file of all that traffic that can later be viewed with Wireshark if you want a nice GUI tool. If you want to read that file using tcpdump there is already a pretty good answer here:

If you are a native english speaker, creating more strict filter is just a matter of adding additional objects to tcpdump [expression] . Example to isolate the filtered host by destination and port to 80:

tcpdump -i eth0 -w /tmp/tcpdump.pcap dst host IP.OF.THE.SERVER and dst port 80
  • 2
    tcpdump can also display the data by itself, but it may not be as pretty. – Kusalananda Mar 19 at 20:38
  • That's why i suggested Wireshark :) – user34720 Mar 19 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.