commandline packet analyzer

learn more… | top users | synonyms

0
votes
1answer
497 views

Detect HTTP sessions using tcpdump [closed]

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
2
votes
1answer
1k views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
1
vote
1answer
472 views

What does this tcpdump printout mean?

I'm not very experience with networking, so on my free time, I usually try and learn some more things about the internet and how it works. While at school, I came across tcpdump and wanted to give it ...
5
votes
2answers
9k views

tcpdump promiscuous mode on OSX 10.8

By examining my wireless router configuration I can see there's 2 IPs assigned: 192.168.1.100 -> laptop (Macbook Air OSX 10.8.2, where I runtcpdump) 192.168.1.101 -> ipad But then if I run: sudo ...
1
vote
1answer
1k views

TCPDUMP -G option

Can anyone give me examples of the TCPDUMP -G use with 60 seconds as a example and incremental files? like : tcpdump -w %s -G 60 i try it but don't increment files only reset the file each ...
0
votes
1answer
668 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
6
votes
1answer
2k views

Traffic between VirtualBox guests not showing up in tcpdump

I have a test environment setup with 4 VirtualBox guests running CentOS 6. Each has one network device attached to a bridged adapter, which is my primary network connection on my PC, with a static IP ...
0
votes
2answers
1k views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
3
votes
1answer
171 views

How to output a simple network activity plot in console in Linux?

There's tload that plots load average. There's iftop that network usage as bars. How to do something like this: # tcpdump -i eth0 --plot 'host 1.2.3.4' 13:45:03 | | 0 in 0 ...
4
votes
1answer
352 views

understanding the tcp header

The first 16 bits in a tcp header, (rfc793), are for the source port, right? The next 16 are for the destination port. When I run tcpdump -xx I can recognise MAC addresses of boxes on my system. Does ...
2
votes
2answers
473 views

Is there a serious issue with setting the SUID bit on tcpdump?

I'm running tcpdump on a remote machine, and piping the output to Wireshark on my local machine over SSH. In order to do this, I had to set the SUID bit on tcpdump. For background, the remote machine ...
19
votes
3answers
13k views

Can I monitor a local unix domain socket like tcpdump?

I'd like to monitor responses on a unix socket without disturbing the original connections and pipe them to a script for processing. I know how to do this with tcpdump for tcp connections but I ...
0
votes
1answer
592 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
0
votes
2answers
696 views

TCP packets not captured by PHP listener

I have a device (GPS localizer) that is sending TCP (I think so) packets to my server on given IP address and through given port. Since I have only SSH access to that server, I opened up two sessions ...
8
votes
3answers
63k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
2
votes
2answers
524 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
0
votes
2answers
1k views

Discover the public ip of a network without being connected

Let say, I'm next to a network and can see the traffic (with airodump or similar tool) but can not decipher it (because I am not connected on the network). Is it possible to discover the public ip ...
1
vote
0answers
170 views

tcpdump loses connection

I'm on Ubuntu – but it's the same on Debian. I'm using tcpdump in order to track the connection of computers on my private network. At some point, the internet connection of the computers launching ...
1
vote
0answers
517 views

latency measurement on Linux-based router using tcpdump

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
2
votes
2answers
1k views

Why can't I see other computers' traffic in the output of tcpdump?

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet. It is only when I begin to use internet by visiting a website ...
0
votes
2answers
2k views

Is there a tool to decrypt all SSL/SSH traffic originating from this computer?

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with ...
1
vote
2answers
725 views

How can I monitor which applications make DNS requests on OS X?

I'm trying to send all of my unencrypted day-to-day traffic over an SSH tunnel, which is working pretty well with a simple SOCKS proxy. Skype still goes outside, but that's okay, as Skype is ...
0
votes
2answers
218 views

Able to write on stdout but not in a file

I want to keep a trace of the URL I visit, so I use a command line like this: tcpdump -ien1 -v -X 'tcp port 80' | sed -nl 's/^.0x[0-9a-f]{4}:.{43}(.)$/\1/p' |perl break.pl |perl -pe ...
4
votes
1answer
2k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
1
vote
1answer
767 views

Log all http and https traffic that goes to the router in OSX

My router has ip 192.168.0.1. How can I log all the traffic it receives under http and https(port 443)? I think using tcpdump should do the trick but I'm not sure how to run it
2
votes
2answers
2k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
4
votes
2answers
7k views

How to make tcpdump (or other tool) to actually dump TCP stream?

I expect something like this: $ nc example.com 80 GET / HTTP/1.0 HTTP/1.0 500 K.O. Content-Type: application/null Content-Length: -1 $ Meanwhile: # tcpdump -i eth0 --actually-dump-all-tcp ...
2
votes
4answers
998 views

capture local network traffic

I have a PS3 and I am going to capture the PS3 traffic. However, how can I capture it with wireshark? Because when I capture it, it only shows the traffic to my computer only. For example, PC ...
4
votes
4answers
6k views

How to capture last N seconds of packets using tcpdump

How can I capture the last N seconds of packets using tcpdump?
0
votes
3answers
1k views

Using nc (netcat) to emulate NTP server response

I want to test some security on an NTP client developed in-house and would like to use netcat to do it. I have packets captured with Wireshark from previous NTP exchanges that I tried to feed to the ...
6
votes
5answers
23k views

Practical Tcpdump examples? [closed]

I want to collect tcpdump examples, as many as possible! E.g.: how to filter FTP passwords on eth0; OR how to filter HTTP 404 errors, etc.
1
vote
1answer
6k views

How do I make tcpdump to write to file for each packet it captures?

I'm running the following version of tcpdump: tcpdump version 4.0.0 libpcap version 1.0.0 I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the ...
8
votes
1answer
5k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
5
votes
1answer
760 views

Linux interface stops receiving packets as seen by tcpdump

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN. There is an IP configured on eth1. eth0 is up but no IP is configured. This interface is used for sniffing with ...
1
vote
2answers
1k views

Count exchanged bytes per TCP connection

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually ...
0
votes
1answer
2k views

tcpdump not showing all packets? [duplicate]

Possible Duplicate: my tcpdump always filters packets? I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the ...
0
votes
1answer
318 views

my tcpdump always filters packets?

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just: ...
1
vote
1answer
1k views

tcpdump missing on Cygwin v1.7.7 for packet sniffing

I am trying to debug why my TCP packets are truncated. I see that only the first 24 bytes of each packet are showing up in my program. The 25th through 28th bytes are scrambled and all others after ...
4
votes
1answer
989 views

How to ssh in the face of huge (25 second) latency?

I need to create an ssh connection between two Linux machines running Centos v5 but the latency could be as high as 25 seconds. I find that if I test something approaching this configuration ...