Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I expect something like this:

$ nc example.com 80
GET / HTTP/1.0

HTTP/1.0 500 K.O.
Content-Type: application/null
Content-Length: -1
$ 

Meanwhile: 
# tcpdump -i eth0 --actually-dump-all-tcp
217.21.51.1:56812->192.0.43.10:80 GET / HTTP/1.0
217.21.51.1:56812->192.0.43.10:80 
217.21.51.1:56812<-192.0.43.10:80 HTTP/1.0 500 K.O.
217.21.51.1:56812<-192.0.43.10:80 Content-Type: application/null
217.21.51.1:56812<-192.0.43.10:80 Content-Length: -1

Now I use Wireshark, but while it is loading the connection cat get finished several times.

share|improve this question
    
tcpdump does actually dump a TCP stream. What are you looking for specifically? Are you trying to capture only one specific TCP session? – Flimzy Jul 8 '11 at 19:34
    
@Flimzy No, he wants to dump in ASCII. – new123456 Jul 8 '11 at 19:59
up vote 2 down vote accepted

tcpdump normally displays packet information, as opposed to actual data.

Use the -A flag to dump ASCII contents. It will still dump a lot of other data (like ARP and DNS packets, for example), but you should be able to get what you want through filters.

share|improve this answer
    
Dirty oneliner to print in form that is closer to mine: tcpdump -n -A -i eth0 | perl -ne 'if(/\d\d:\d\d:\d\d\.\d{6} IP (\d+\.\d+\.\d+\.\d+)\.(\d+) > (\d+\.\d+\.\d+\.\d+)\.(\d+)\:.*length (\d+)/) { $preamble="$1:$2->$3:$4 "; } else { print "$preamble$_"; }' – Vi. Jul 8 '11 at 20:38
    
@Vi If my brain weren't fortified from working with setjmp/longjmp hackery, that Perl would have fried my brain. I'm sure Douglas would have a fit if he saw that ;) – new123456 Jul 8 '11 at 20:54

Try

tcpflow -v -i iface

This will create a lot of files having filenames like "IP_A.port.-IP_B.port".

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .