Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I expect something like this:

$ nc example.com 80
GET / HTTP/1.0

HTTP/1.0 500 K.O.
Content-Type: application/null
Content-Length: -1
$ 

Meanwhile: 
# tcpdump -i eth0 --actually-dump-all-tcp
217.21.51.1:56812->192.0.43.10:80 GET / HTTP/1.0
217.21.51.1:56812->192.0.43.10:80 
217.21.51.1:56812<-192.0.43.10:80 HTTP/1.0 500 K.O.
217.21.51.1:56812<-192.0.43.10:80 Content-Type: application/null
217.21.51.1:56812<-192.0.43.10:80 Content-Length: -1

Now I use Wireshark, but while it is loading the connection cat get finished several times.

share|improve this question
    
tcpdump does actually dump a TCP stream. What are you looking for specifically? Are you trying to capture only one specific TCP session? –  Flimzy Jul 8 '11 at 19:34
    
@Flimzy No, he wants to dump in ASCII. –  new123456 Jul 8 '11 at 19:59
add comment

2 Answers

up vote 2 down vote accepted

tcpdump normally displays packet information, as opposed to actual data.

Use the -A flag to dump ASCII contents. It will still dump a lot of other data (like ARP and DNS packets, for example), but you should be able to get what you want through filters.

share|improve this answer
    
Dirty oneliner to print in form that is closer to mine: tcpdump -n -A -i eth0 | perl -ne 'if(/\d\d:\d\d:\d\d\.\d{6} IP (\d+\.\d+\.\d+\.\d+)\.(\d+) > (\d+\.\d+\.\d+\.\d+)\.(\d+)\:.*length (\d+)/) { $preamble="$1:$2->$3:$4 "; } else { print "$preamble$_"; }' –  Vi. Jul 8 '11 at 20:38
    
@Vi If my brain weren't fortified from working with setjmp/longjmp hackery, that Perl would have fried my brain. I'm sure Douglas would have a fit if he saw that ;) –  new123456 Jul 8 '11 at 20:54
add comment

Try

tcpflow -v -i iface

This will create a lot of files having filenames like "IP_A.port.-IP_B.port".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.