commandline packet analyzer

learn more… | top users | synonyms

1
vote
0answers
365 views

latency measurement on Linux-based router using tcpdump

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
2
votes
2answers
947 views

Why can't I see other computers' traffic in the output of tcpdump?

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet. It is only when I begin to use internet by visiting a website ...
0
votes
2answers
2k views

Is there a tool to decrypt all SSL/SSH traffic originating from this computer?

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with ...
1
vote
2answers
568 views

How can I monitor which applications make DNS requests on OS X?

I'm trying to send all of my unencrypted day-to-day traffic over an SSH tunnel, which is working pretty well with a simple SOCKS proxy. Skype still goes outside, but that's okay, as Skype is ...
0
votes
2answers
190 views

Able to write on stdout but not in a file

I want to keep a trace of the URL I visit, so I use a command line like this: tcpdump -ien1 -v -X 'tcp port 80' | sed -nl 's/^.0x[0-9a-f]{4}:.{43}(.)$/\1/p' |perl break.pl |perl -pe ...
4
votes
1answer
2k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
1
vote
1answer
706 views

Log all http and https traffic that goes to the router in OSX

My router has ip 192.168.0.1. How can I log all the traffic it receives under http and https(port 443)? I think using tcpdump should do the trick but I'm not sure how to run it
0
votes
2answers
2k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
4
votes
2answers
5k views

How to make tcpdump (or other tool) to actually dump TCP stream?

I expect something like this: $ nc example.com 80 GET / HTTP/1.0 HTTP/1.0 500 K.O. Content-Type: application/null Content-Length: -1 $ Meanwhile: # tcpdump -i eth0 --actually-dump-all-tcp ...
2
votes
4answers
850 views

capture local network traffic

I have a PS3 and I am going to capture the PS3 traffic. However, how can I capture it with wireshark? Because when I capture it, it only shows the traffic to my computer only. For example, PC ...
3
votes
2answers
3k views

How to capture last N seconds of packets using tcpdump

How can I capture the last N seconds of packets using tcpdump?
0
votes
3answers
1k views

Using nc (netcat) to emulate NTP server response

I want to test some security on an NTP client developed in-house and would like to use netcat to do it. I have packets captured with Wireshark from previous NTP exchanges that I tried to feed to the ...
5
votes
5answers
19k views

Practical Tcpdump examples? [closed]

I want to collect tcpdump examples, as many as possible! E.g.: how to filter FTP passwords on eth0; OR how to filter HTTP 404 errors, etc.
0
votes
1answer
5k views

How do I make tcpdump to write to file for each packet it captures?

I'm running the following version of tcpdump: tcpdump version 4.0.0 libpcap version 1.0.0 I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the ...
7
votes
1answer
4k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
5
votes
1answer
587 views

Linux interface stops receiving packets as seen by tcpdump

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN. There is an IP configured on eth1. eth0 is up but no IP is configured. This interface is used for sniffing with ...
1
vote
2answers
1k views

Count exchanged bytes per TCP connection

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually ...
0
votes
1answer
1k views

tcpdump not showing all packets? [duplicate]

Possible Duplicate: my tcpdump always filters packets? I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the ...
0
votes
1answer
282 views

my tcpdump always filters packets?

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just: ...
0
votes
1answer
1k views

tcpdump missing on Cygwin v1.7.7 for packet sniffing

I am trying to debug why my TCP packets are truncated. I see that only the first 24 bytes of each packet are showing up in my program. The 25th through 28th bytes are scrambled and all others after ...
4
votes
1answer
837 views

How to ssh in the face of huge (25 second) latency?

I need to create an ssh connection between two Linux machines running Centos v5 but the latency could be as high as 25 seconds. I find that if I test something approaching this configuration ...