Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to collect tcpdump examples, as many as possible!

E.g.: how to filter FTP passwords on eth0; OR how to filter HTTP 404 errors, etc.

share|improve this question

closed as not constructive by slhck Aug 17 '12 at 21:02

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

5 Answers

up vote 2 down vote accepted

It doesn't do any filtering, but this example creates a handy continuous packet sniffer:

tcpdump -n -C 128 -W 100 -z /home/user/compress_logs.pl -i br0 -w /home/user/packetlogs/packetlog.pcap &
  • -n don't do reverse lookup on IPs, don't convert port numbers to text descriptions, don't convert MAC addesses to names, etc..
  • -C 128 rotate capture files every 128,000,000 bytes
  • -W 100 limit the number of capture files being rotated (see -C) to 100
  • -z /home/user/compress_logs.pl run script compress_logs.pl on each rotated capture file
  • -i br0 capture on interface br0
  • -w /home/user/packetlogs/packetlog.pcap use file name /home/user/packetlogs/packetlog.pcap
  • & this is parsed by bash; indicates that the command should be run in the background (asynchronously)

Put it in /etc/rc.local to run on boot. It captures all packets on interface br0, which could be two interfaces in-line as a tap or two interfaces hooked to a passive tap, or one interface hooked to a mirrored switch port (I've used all three in practice)

It writes ~128MB files and will automatically rotate up to 100 of them. When it captures 128MB of data, it will close the file, open a new one, and fork the specified command with the old filename as an argument - in this case a little Perl script that compresses the previous capture file for quicker transfer off the IDS server.

I use this when I have to monitor a connection for a long time (like a day or two) and need to go back and find an event that occurred at a specific time. The small files are much easier to handle in Wireshark than one huge pcap file.

share|improve this answer
    
this ones the best so far :) –  LanceBaynes Jun 24 '11 at 13:40
add comment

Capture only HTTP POST data:

tcpdump tcp[2:2] = 80 and \(tcp[20:4] = 1347375956 
or tcp[24:4] = 1347375956 
or tcp[28:4] = 1347375956 
or tcp[32:4] = 1347375956 
or tcp[36:4] = 1347375956 
or tcp[40:4] = 1347375956 
or tcp[44:4] = 1347375956 
or tcp[48:4] = 1347375956 
or tcp[52:4] = 1347375956 
or tcp[56:4] = 1347375956 
or tcp[60:4] = 1347375956\)

A bit unwieldly but certainly useful. tcp[2:2] captures, starting from position 2 of the TCP header, 2 bytes (which are the port, port 80 being for HTTP traffic).

Then we want to compare the first 4 bytes of TCP data to 'POST'. The TCP header is minimum 20 (decimal) bytes, but since the TCP options are variable length, from 0 to 40 bytes (padded to a 32-bit boundary and starting at ), we have to test every 4 bytes from 20 to 60 (decimal). Finally, 1347375956 is the base10 big-endian binary representation of the ASCII text 'POST'. Use the values below for other HTTP types:

  • GET 1195725856 (includes the space after 'GET' which is needed because we are comparing with 4 bytes)
  • POST 1347375956
  • PUT 1347769376 (includes space)
  • DELETE 1145392197 (just 'DELE', actually)

How to translate POST to 1347375956:

First we have the uppercase letters P,O,S,T. If you look at an ASCII to HEX table (http://www.asciitable.com/), you will see: P = 0x50 O = 0x4f S = 0x53 T = 0x54

Then we put it into a long HEX number. 0x504f5354, and start the HEX to DEC conversion from the right side. 4 X 16^0 = 4 5 X 16^1 = 80 3 X 16^2 = 768 5 X 16^3 = 20480 f X 16^4 = 983040 (remember 0xf = 15) 4 X 16^5 = 4194304 0 X 16^6 = 0 5 X 16^7 = 1342177280

Sum of all 1347375956 = POST

share|improve this answer
add comment

Capture everything to a file (so you can analyze it later with Wireshark or something):

sudo tcpdump -i en0 -s0 -w ~/capture.pcap
  • -i en0 capture on interface en0
  • -s0 use the whole packet (don't truncate -- snarf 0)
  • -w ~/capture.pcap write to packet capture file ~/capture.pcap
share|improve this answer
add comment

If you want to monitor clients DNS requests on an OpenWRT router:

tcpdump -n -i br-lan dst port 53
  • -n don't do reverse lookup on IPs, don't convert port numbers to text descriptions, don't convert MAC addesses to names, etc..
  • -i br-lan capture on interface br-lan
  • dst port 53 filter destination port 53, the port for DNS service
share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.