Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Working with basic windump commands when capturing all packets its working in window 7

windump -i 1 -w file

But when filtering port its not working

windump -i 1 -w file port 80


0 packet captured
843 packet recieved by filter
0 packets dropped by kernel

npf and remote packet capturing protgocol are running

Also same command working on window XP virtual machine

share|improve this question

migrated from Mar 2 '13 at 18:53

This question came from our site for information security professionals.

Check your firewall (Firewall service should be started, but disabled in Control panels) Any other config on Server 2008 and newer is unpredictable. – LamonteCristo Mar 2 '13 at 18:53

The best way to validate this is to run wireshark with the filter tcp.port==80 also check if you have permission for the file.

I have seen the screen-shot basically whats wrong is the order of switches in the command you should use port 80 like this windump -i 1 port 80 > port.txt

share|improve this answer
Yes wireshark works well,but was learning tcpdump usage and this problem rised – user162098 Feb 28 '13 at 3:32
Thats great to learn to multiple tools; but you should know what information you are looking for as almost all sniffing software have the same functionality its just comes to reliability. I have the win 7 64 bit and the commands works for me the way its done is the i look at the windump -i 1 -A port 8080 > file1.txt – asadz Feb 28 '13 at 5:35
@azadz :thanks for reply but the problem is that if not defining any filtering (like here port 80) its captuuring data but after applying filter its recieving packets but not capturing.I also tried your command but got same problem. – user162098 Feb 28 '13 at 11:18
can you explain what you mean by capturing ? is the filter capturing traffic related to port 80, if not try seeing if your are behind proxy in that case the port would be different. Try to see if the firewall is open, disable it. – asadz Feb 28 '13 at 12:07
here is the image of two different commands one with filter and one without filter.Later one is working like charm and capturing packets and saving to a file image – user162098 Feb 28 '13 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .