Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm using tcpdump for some tests I want to see the IP and port number but the output of tcpdump is like

IP pl1snu.koren.kr.http > kitch.pl.sophia.inria.fr.dnp: Flags [P.], seq 54:72, ack 1, win 5792, length 18

it only shows the hostname and the protocol for http, it is easy to know it is 80 but for dnp I have to search

so is it possible to how to make tcpdump to display ip and port number but not hostname and protocol if so , how? thanks

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Add -n to your tcpdump command line.

From the tcpdump manpage:

-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

share|improve this answer
    
port number is still converted to protocol name using -n –  misteryes Apr 24 '13 at 22:36
    
"port number is still converted to protocol name using -n" Not with, for example, the tcpdump 4.1.1 that comes with OS X Mountain Lion or with tcpdump built from the top of the tcpdump.org Git trunk. On what version of tcpdump are you seeing -n not suppress the conversion of port numbers to protocol names? –  Guy Harris Aug 23 '13 at 17:52
add comment

I think the best approach is:

sudo tcpdump -ni any

Steps to test:

  1. Open a console and type:

    sudo nc -l -p 6666
    
  2. Open another console and type:

    sudo tcpdump -ni any
    

    If the output is too verbose you can filter it out (| grep -v "patter1n|pattern2")

  3. Open a third console and type:

    telnet localhost 6666
    

Expected output:

10:37:13.770997 IP 127.0.0.1.56920 > 127.0.0.1.443: Flags [S], seq 2822288041, win 43690, options [mss 65495,sackOK,TS val 1028779 ecr 0,nop,wscale 7], length 0

If you use sudo tcpdump -i any you will see something like this:

10:38:22.106022 IP localhost.56924 > localhost.https: Flags [S], seq 3147104744, win 43690, options [mss 65495,sackOK,TS val 1045863 ecr 0,nop,wscale 7], length 0
share|improve this answer
    
That's the same as the other answer - the -i any isn't necessary if you want to suppress address/port-to-name conversion, it's just the -n that matters. –  Guy Harris Aug 23 '13 at 17:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.