Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I expect something like this:

$ nc 80
GET / HTTP/1.0

HTTP/1.0 500 K.O.
Content-Type: application/null
Content-Length: -1

# tcpdump -i eth0 --actually-dump-all-tcp> GET / HTTP/1.0><- HTTP/1.0 500 K.O.<- Content-Type: application/null<- Content-Length: -1

Now I use Wireshark, but while it is loading the connection cat get finished several times.

share|improve this question
tcpdump does actually dump a TCP stream. What are you looking for specifically? Are you trying to capture only one specific TCP session? – Flimzy Jul 8 '11 at 19:34
@Flimzy No, he wants to dump in ASCII. – new123456 Jul 8 '11 at 19:59
up vote 2 down vote accepted

tcpdump normally displays packet information, as opposed to actual data.

Use the -A flag to dump ASCII contents. It will still dump a lot of other data (like ARP and DNS packets, for example), but you should be able to get what you want through filters.

share|improve this answer
Dirty oneliner to print in form that is closer to mine: tcpdump -n -A -i eth0 | perl -ne 'if(/\d\d:\d\d:\d\d\.\d{6} IP (\d+\.\d+\.\d+\.\d+)\.(\d+) > (\d+\.\d+\.\d+\.\d+)\.(\d+)\:.*length (\d+)/) { $preamble="$1:$2->$3:$4 "; } else { print "$preamble$_"; }' – Vi. Jul 8 '11 at 20:38
@Vi If my brain weren't fortified from working with setjmp/longjmp hackery, that Perl would have fried my brain. I'm sure Douglas would have a fit if he saw that ;) – new123456 Jul 8 '11 at 20:54


tcpflow -v -i iface

This will create a lot of files having filenames like "IP_A.port.-IP_B.port".

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.