Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Guys im trying to test a tcpdump to google.com (im new to Linux by the way).

so here's what i typed in my shell:

$tcpdump src 192.168.1.xxx and dst www.google.com and port ftp

but i get this error:

tcpdump: no suitable device found

what could be the cause guys?

share|improve this question

migrated from stackoverflow.com May 31 '13 at 10:46

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 3 down vote accepted

tcpdump is for capturing packets flowing into or out of your network interface (ethernet or wifi) or usb port etc. You will have to specify what interface you want to listen on. Use the command ifconfig to figure out the names of all the network interfaces present of your system. On my computer, the ifconfig command gives me:

eth6      Link encap:Ethernet  HWaddr 08:00:27:9a:24:9d  
          inet addr:10.0.0.21  Bcast:10.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:69 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:7131 (7.1 KB)  TX bytes:1350 (1.3 KB)
          Interrupt:10 Base address:0xd020 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:400 (400.0 B)  TX bytes:400 (400.0 B)

Which shows the name of my ethernet interface as eth6. You will notice that it has the IPv4 address assigned to it as 10.0.0.21 which tells me that my network connection (to my WiFi Router) is working fine.

So I will issue the command:sudo tcpdump -i eth6 dst www.google.com This will start tcpdump which will capture all packets flowing into and out of my eth6 but it will display only this packets which are destined to www.google.com

Now I need to create a connection to www.google.com, so in a separate terminal window, I type: wget www.google.com This will fetch the homepage (index.html) from google.com.

When I switch back to the tcpdump's terminal window, I get:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth6, link-type EN10MB (Ethernet), capture size 65535 bytes
15:05:50.436200 IP anurag-VirtualBox.33365 > maa03s05-in-f16.1e100.net.www: Flags [S], seq 4292128566, win 5840, options [mss 1460,sackOK,TS val 4294949922 ecr 0,nop,wscale 6], length 0
15:05:50.493477 IP anurag-VirtualBox.33365 > maa03s05-in-f16.1e100.net.www: Flags [.], ack 2638988837, win 92, options [nop,nop,TS val 4294949936 ecr 123640815], length 0
15:05:50.494124 IP anurag-VirtualBox.33365 > maa03s05-in-f16.1e100.net.www: Flags [P.], seq 0:112, ack 1, win 92, options [nop,nop,TS val 4294949936 ecr 123640815], length 112
15:05:50.596428 IP anurag-VirtualBox.33365 > maa03s05-in-f16.1e100.net.www: Flags [.], ack 1013, win 123, options [nop,nop,TS val 4294949962 ecr 123640915], length 0
15:05:50.901037 IP anurag-VirtualBox.33365 > maa03s05-in-f16.1e100.net.www: Flags [F.], seq 112, ack 1013, win 123, options [nop,nop,TS val 4294950038 ecr 123640915], length 0
15:05:50.956092 IP anurag-VirtualBox.33365 > maa03s05-in-f16.1e100.net.www: Flags [.], ack 1014, win 123, options [nop,nop,TS val 4294950052 ecr 123641277], length 0
^C
6 packets captured
10 packets received by filter
0 packets dropped by kernel
share|improve this answer
    
when i issue the command tcpdump, will this constantly monitor me and display those packets captured in the terminal? or these packets captured are stored somwhere? –  Monkey May 30 '13 at 9:46
1  
The packets will be captured and displayed live in realtime as the traffic flows in and out. If you want to store the packets in a file on hard disk use the -w flag as described in tcpdump's man page here –  lithiumhead May 30 '13 at 10:12

You probably need to execute as superuser in order to access the network device directly.

Sudo the command.

Edit: To clarify, that tcpdump command won't give you much useful information either. Try this:

sudo tcpdump host stackoverflow.com

Or, if sudo is not available:

su - ; tcpdump host stackoverflow.com
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.