Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

Working with basic windump commands when capturing all packets its working in window 7

windump -i 1 -w file

But when filtering port its not working

windump -i 1 -w file port 80

showing

0 packet captured
843 packet recieved by filter
0 packets dropped by kernel

npf and remote packet capturing protgocol are running

Also same command working on window XP virtual machine

share|improve this question
Check your firewall (Firewall service should be started, but disabled in Control panels) Any other config on Server 2008 and newer is unpredictable. – makerofthings7 Mar 2 at 18:53

migrated from security.stackexchange.com Mar 2 at 18:53

1 Answer

up vote 1 down vote

The best way to validate this is to run wireshark with the filter tcp.port==80 also check if you have permission for the file.

I have seen the screen-shot basically whats wrong is the order of switches in the command you should use port 80 like this windump -i 1 port 80 > port.txt

share|improve this answer
Yes wireshark works well,but was learning tcpdump usage and this problem rised – user162098 Feb 28 at 3:32
Thats great to learn to multiple tools; but you should know what information you are looking for as almost all sniffing software have the same functionality its just comes to reliability. I have the win 7 64 bit and the commands works for me the way its done is the i look at the windump -i 1 -A port 8080 > file1.txt – asadz Feb 28 at 5:35
@azadz :thanks for reply but the problem is that if not defining any filtering (like here port 80) its captuuring data but after applying filter its recieving packets but not capturing.I also tried your command but got same problem. – user162098 Feb 28 at 11:18
can you explain what you mean by capturing ? is the filter capturing traffic related to port 80, if not try seeing if your are behind proxy in that case the port would be different. Try to see if the firewall is open, disable it. – asadz Feb 28 at 12:07
here is the image of two different commands one with filter and one without filter.Later one is working like charm and capturing packets and saving to a file image – user162098 Feb 28 at 12:43
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.