commandline packet analyzer

learn more… | top users | synonyms

0
votes
1answer
30 views

Captured packets with tcpdump vs. tcpdump > file

Why is there such difference in number of packets captured by tcpdump when the output is written to console and to file? $ tcpdump ... 1681 packets captured 1681 packets received by filter 0 packets ...
0
votes
1answer
39 views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
1
vote
2answers
56 views

How to quieten tcpdump output when reading a pcap file?

I notice that when using tcpdump to read a pcap file, the tcpdump command somehow manages to print information to my console even when I redirect both STDOUT and STDERR. How can I prevent tcpdump from ...
0
votes
1answer
24 views

Get external email from action “mailto”-form

Is it possible to pick out the email adress that a "mailto"-form will send an external email to? example from this (swedish "ebay" - ad) ...
0
votes
0answers
33 views

OpenVSwitch no traffic on bridge

I setup a bridge(br-int) with OpenVSwitch and plugged in eth3 which is connected to a hub. When other computers send traffic on this hub, I can get those traffic on eth3. However, if I try to do that ...
1
vote
0answers
55 views

No response received from github ssh randomly

My git pull started to stop working randomly with this error $ git pull ssh: connect to host github.com port 22: Connection timed out fatal: The remote end hung up unexpectedly I tried debugging ...
1
vote
2answers
40 views

Different packet sizes on Wi-Fi and 3G interfaces while tethering

I am using an application called android-wifi-tether on a mobile phone. My laptop is connected to the phone over Wi-Fi and the phone is connected to Internet over 3G. I am using tcpdump to sniff ...
0
votes
2answers
175 views

Packet filter logging [currently with tcpdump in background as root]

I am running OS X Mavericks and use the "packet filter" firewall. However, it seems that "pflogd" is not available. I found that you can create an interface named pflog0 and then use tcpdump to see ...
0
votes
2answers
356 views

how to use tcpdump to capture all packets on local network?

I have a home used wireless router, one linux laptop and android connected to it. Lets say the linux has ip 10.5.5.1, mac AA:AA:AA:AA:AA:AA and android has 10.5.5.2, mac AA:AA:AA:AA:AA:AB. The ...
0
votes
1answer
64 views

Detect HTTP sessions using tcpdump

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
0
votes
1answer
25 views

Is there a way to limit number of packet captures with tcpflow?

I want to limit the number of captured packets, such as: tcpdump -c 20 I want to use tcpflow instead. Is this possible? The console throws a syntax error using tcpflow with the -c parameter. edit - ...
0
votes
2answers
144 views

miss /dev/bpf in freebsd

I'm using tcpdump in freebsd, and I got the following error: $ /usr/sbin/tcpdump -i bge0 tcpdump: (cannot open device) /dev/bpf: No such file or directory a few google search indicate that the ...
3
votes
2answers
156 views

Filter packets sent via HTTP to a port other then 80?

I have a database communicating on port 7474 via HTTP (sigh), and I want to debug the queries sent to / from it. However, a filter such as http.request.method == "POST" Filters out every post ...
2
votes
1answer
183 views

Using tcpdump on displayed TCP data

If sudo tcpdump -i eth0 -X gives me tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes ...
0
votes
0answers
200 views

Can't telnet: TCP connection doesn't get established

I am having issues with telnet from a machine. TCP connection is not getting established. SYN gets sent out and SYN_ACK comes back but not sure why the ACK is not getting sent back. I am guessing ...
0
votes
0answers
93 views

How do I see which http requests an android app is doing?

Simply, I've got a Samsung Tablet based on Android that is physically connected to my desktop (running Ubuntu 12.04). How do I capture/see/sniff requests that an app is doing via HTTP? Just to ...
1
vote
1answer
133 views

How to detect packets that are only from the local network and not from the ISP/internet?

I'm building a bandwidth monitor using JNetPcap(java version of libpcap/winpcap). I need to recognise packets within the home network so that I don' count them towards the total bandwidth used. I ...
0
votes
1answer
443 views

have tcpdump show the 'conversation' as i would get from wireshark?

Is it possible to get the same output i would get from: tcpdump port 80 -w log.pcap wireshark log.pcap in wireshark Analyze > Follow TCP Stream and then in the bottom drop down Entire ...
1
vote
2answers
109 views

Check if HTTP calls are gzipped

Assuming that I have an application server (Linux) running on port 80, how can I make sure (with tcpdump, I guess) that all incoming requests are gzipped and all responses are gzipped as well? Also, ...
2
votes
1answer
85 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In ...
0
votes
0answers
403 views

Executing tcpdump remotely while storing packet capture locally

I have run into stumbling block while attempting to create a bash script that will write packet capture files from tcpdump onto a remote server, while displaying the output of the tcpdump command so ...
0
votes
0answers
19 views

Executing tcpdump remotely while storing packet capture locally [duplicate]

I have run into stumbling block while attempting to create a bash script that will write packet capture files from tcpdump onto a remote server, while displaying the output of the tcpdump command so ...
1
vote
2answers
1k views

tcpdump error: no suitable device found in Linux

Guys im trying to test a tcpdump to google.com (im new to Linux by the way). so here's what i typed in my shell: $tcpdump src 192.168.1.xxx and dst www.google.com and port ftp but i get this ...
0
votes
2answers
668 views

TCPDUMP: are these args consistent or meaningless together?

I'm using tcpdump on routing software, and trying to check whether the presence of ip/ip6 protocol with an ip6/ip host (i.e., the other IP family), or else specifying a mix of IPv4 and IPv6 IPs as ...
1
vote
1answer
614 views

How to set NIC in promiscuous mode on mac book air?

I am trying to run my nic on MacOSx at promiscuous mode and then use tshark / tcpdump Option1: ifconfig en0 promisc but I get this message: ifconfig: promisc: bad value Option 2: I tried sudo ...
1
vote
2answers
1k views

how to make tcpdump to display ip and port number but not hostname and protocol

I'm using tcpdump for some tests I want to see the IP and port number but the output of tcpdump is like IP pl1snu.koren.kr.http > kitch.pl.sophia.inria.fr.dnp: Flags [P.], seq 54:72, ack 1, win ...
0
votes
1answer
308 views

Detect HTTP sessions using tcpdump [closed]

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
1
vote
1answer
473 views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
1
vote
1answer
342 views

What does this tcpdump printout mean?

I'm not very experience with networking, so on my free time, I usually try and learn some more things about the internet and how it works. While at school, I came across tcpdump and wanted to give it ...
3
votes
2answers
5k views

tcpdump promiscuous mode on OSX 10.8

By examining my wireless router configuration I can see there's 2 IPs assigned: 192.168.1.100 -> laptop (Macbook Air OSX 10.8.2, where I runtcpdump) 192.168.1.101 -> ipad But then if I run: sudo ...
1
vote
1answer
422 views

TCPDUMP -G option

Can anyone give me examples of the TCPDUMP -G use with 60 seconds as a example and incremental files? like : tcpdump -w %s -G 60 i try it but don't increment files only reset the file each ...
0
votes
1answer
344 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
4
votes
1answer
1k views

Traffic between VirtualBox guests not showing up in tcpdump

I have a test environment setup with 4 VirtualBox guests running CentOS 6. Each has one network device attached to a bridged adapter, which is my primary network connection on my PC, with a static IP ...
0
votes
2answers
640 views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
2
votes
1answer
105 views

How to output a simple network activity plot in console in Linux?

There's tload that plots load average. There's iftop that network usage as bars. How to do something like this: # tcpdump -i eth0 --plot 'host 1.2.3.4' 13:45:03 | | 0 in 0 ...
4
votes
1answer
192 views

understanding the tcp header

The first 16 bits in a tcp header, (rfc793), are for the source port, right? The next 16 are for the destination port. When I run tcpdump -xx I can recognise MAC addresses of boxes on my system. Does ...
2
votes
2answers
290 views

Is there a serious issue with setting the SUID bit on tcpdump?

I'm running tcpdump on a remote machine, and piping the output to Wireshark on my local machine over SSH. In order to do this, I had to set the SUID bit on tcpdump. For background, the remote machine ...
7
votes
2answers
5k views

Can I monitor a local unix domain socket like tcpdump?

I'd like to monitor responses on a unix socket without disturbing the original connections and pipe them to a script for processing. I know how to do this with tcpdump for tcp connections but I ...
0
votes
1answer
355 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
0
votes
2answers
424 views

TCP packets not captured by PHP listener

I have a device (GPS localizer) that is sending TCP (I think so) packets to my server on given IP address and through given port. Since I have only SSH access to that server, I opened up two sessions ...
0
votes
3answers
24k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
2
votes
2answers
404 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
0
votes
2answers
587 views

Discover the public ip of a network without being connected

Let say, I'm next to a network and can see the traffic (with airodump or similar tool) but can not decipher it (because I am not connected on the network). Is it possible to discover the public ip ...
1
vote
0answers
146 views

tcpdump loses connection

I'm on Ubuntu – but it's the same on Debian. I'm using tcpdump in order to track the connection of computers on my private network. At some point, the internet connection of the computers launching ...
1
vote
0answers
311 views

latency measurement on Linux-based router using tcpdump

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
2
votes
2answers
666 views

Why can't I see other computers' traffic in the output of tcpdump?

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet. It is only when I begin to use internet by visiting a website ...
0
votes
2answers
1k views

Is there a tool to decrypt all SSL/SSH traffic originating from this computer?

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with ...
1
vote
2answers
479 views

How can I monitor which applications make DNS requests on OS X?

I'm trying to send all of my unencrypted day-to-day traffic over an SSH tunnel, which is working pretty well with a simple SOCKS proxy. Skype still goes outside, but that's okay, as Skype is ...
0
votes
2answers
177 views

Able to write on stdout but not in a file

I want to keep a trace of the URL I visit, so I use a command line like this: tcpdump -ien1 -v -X 'tcp port 80' | sed -nl 's/^.0x[0-9a-f]{4}:.{43}(.)$/\1/p' |perl break.pl |perl -pe ...
4
votes
1answer
1k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...