0
votes
1answer
32 views

Captured packets with tcpdump vs. tcpdump > file

Why is there such difference in number of packets captured by tcpdump when the output is written to console and to file? $ tcpdump ... 1681 packets captured 1681 packets received by filter 0 packets ...
0
votes
1answer
39 views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
1
vote
2answers
58 views

How to quieten tcpdump output when reading a pcap file?

I notice that when using tcpdump to read a pcap file, the tcpdump command somehow manages to print information to my console even when I redirect both STDOUT and STDERR. How can I prevent tcpdump from ...
1
vote
0answers
55 views

No response received from github ssh randomly

My git pull started to stop working randomly with this error $ git pull ssh: connect to host github.com port 22: Connection timed out fatal: The remote end hung up unexpectedly I tried debugging ...
0
votes
2answers
358 views

how to use tcpdump to capture all packets on local network?

I have a home used wireless router, one linux laptop and android connected to it. Lets say the linux has ip 10.5.5.1, mac AA:AA:AA:AA:AA:AA and android has 10.5.5.2, mac AA:AA:AA:AA:AA:AB. The ...
0
votes
0answers
407 views

Executing tcpdump remotely while storing packet capture locally

I have run into stumbling block while attempting to create a bash script that will write packet capture files from tcpdump onto a remote server, while displaying the output of the tcpdump command so ...
1
vote
2answers
1k views

tcpdump error: no suitable device found in Linux

Guys im trying to test a tcpdump to google.com (im new to Linux by the way). so here's what i typed in my shell: $tcpdump src 192.168.1.xxx and dst www.google.com and port ftp but i get this ...
1
vote
2answers
1k views

how to make tcpdump to display ip and port number but not hostname and protocol

I'm using tcpdump for some tests I want to see the IP and port number but the output of tcpdump is like IP pl1snu.koren.kr.http > kitch.pl.sophia.inria.fr.dnp: Flags [P.], seq 54:72, ack 1, win ...
0
votes
1answer
308 views

Detect HTTP sessions using tcpdump [closed]

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
1
vote
1answer
425 views

TCPDUMP -G option

Can anyone give me examples of the TCPDUMP -G use with 60 seconds as a example and incremental files? like : tcpdump -w %s -G 60 i try it but don't increment files only reset the file each ...
0
votes
2answers
640 views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
2
votes
1answer
105 views

How to output a simple network activity plot in console in Linux?

There's tload that plots load average. There's iftop that network usage as bars. How to do something like this: # tcpdump -i eth0 --plot 'host 1.2.3.4' 13:45:03 | | 0 in 0 ...
0
votes
2answers
1k views

Is there a tool to decrypt all SSL/SSH traffic originating from this computer?

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with ...
0
votes
2answers
177 views

Able to write on stdout but not in a file

I want to keep a trace of the URL I visit, so I use a command line like this: tcpdump -ien1 -v -X 'tcp port 80' | sed -nl 's/^.0x[0-9a-f]{4}:.{43}(.)$/\1/p' |perl break.pl |perl -pe ...
3
votes
2answers
4k views

How to make tcpdump (or other tool) to actually dump TCP stream?

I expect something like this: $ nc example.com 80 GET / HTTP/1.0 HTTP/1.0 500 K.O. Content-Type: application/null Content-Length: -1 $ Meanwhile: # tcpdump -i eth0 --actually-dump-all-tcp ...
5
votes
1answer
500 views

Linux interface stops receiving packets as seen by tcpdump

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN. There is an IP configured on eth1. eth0 is up but no IP is configured. This interface is used for sniffing with ...
1
vote
2answers
1k views

Count exchanged bytes per TCP connection

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually ...