Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The first 16 bits in a tcp header, (rfc793), are for the source port, right? The next 16 are for the destination port. When I run tcpdump -xx I can recognise MAC addresses of boxes on my system. Does this mean that the "ports" are MAC addresses?

share|improve this question
What is the switch -xx doing?, I only see -x and -X in the man page for tcpdump. The only switches I see that support multiple copies are v, t, n, and d – Scott Chamberlain Oct 31 '12 at 17:16
@ScottChamberlain: Which version of tcpdump are you using? 4.3.0 has -xx. – grawity Oct 31 '12 at 17:19
@grawity I don't have my box near me right now so I just googled it and got here – Scott Chamberlain Oct 31 '12 at 17:21
@ScottChamberlain: That one is from 2002. The latest version is on the official website. – grawity Oct 31 '12 at 17:29

No, they aren't.

Regardless of its name, tcpdump captures packets at the lowest possible level – it doesn't limit itself to just TCP.

When you use -xx, tcpdump outputs the link layer header of all packets, so the first 4 bytes of the output aren't TCP – they are part of the Ethernet frame.

Even with plain -x, tcpdump would print the IP header before TCP/UDP.

If you want to see the packet structure, use Wireshark instead – it will display every packet as a tree, and highlight the specific bytes for every value.

share|improve this answer
Great! So it looks like I was using the wrong options and was getting the link layer include. – jayeola Oct 31 '12 at 17:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .