commandline packet analyzer

learn more… | top users | synonyms

6
votes
1answer
2k views

Traffic between VirtualBox guests not showing up in tcpdump

I have a test environment setup with 4 VirtualBox guests running CentOS 6. Each has one network device attached to a bridged adapter, which is my primary network connection on my PC, with a static IP ...
0
votes
2answers
1k views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
3
votes
1answer
168 views

How to output a simple network activity plot in console in Linux?

There's tload that plots load average. There's iftop that network usage as bars. How to do something like this: # tcpdump -i eth0 --plot 'host 1.2.3.4' 13:45:03 | | 0 in 0 ...
4
votes
1answer
326 views

understanding the tcp header

The first 16 bits in a tcp header, (rfc793), are for the source port, right? The next 16 are for the destination port. When I run tcpdump -xx I can recognise MAC addresses of boxes on my system. Does ...
2
votes
2answers
451 views

Is there a serious issue with setting the SUID bit on tcpdump?

I'm running tcpdump on a remote machine, and piping the output to Wireshark on my local machine over SSH. In order to do this, I had to set the SUID bit on tcpdump. For background, the remote machine ...
16
votes
3answers
11k views

Can I monitor a local unix domain socket like tcpdump?

I'd like to monitor responses on a unix socket without disturbing the original connections and pipe them to a script for processing. I know how to do this with tcpdump for tcp connections but I ...
0
votes
1answer
555 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
0
votes
2answers
626 views

TCP packets not captured by PHP listener

I have a device (GPS localizer) that is sending TCP (I think so) packets to my server on given IP address and through given port. Since I have only SSH access to that server, I opened up two sessions ...
5
votes
3answers
55k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
2
votes
2answers
490 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
0
votes
2answers
995 views

Discover the public ip of a network without being connected

Let say, I'm next to a network and can see the traffic (with airodump or similar tool) but can not decipher it (because I am not connected on the network). Is it possible to discover the public ip ...
1
vote
0answers
163 views

tcpdump loses connection

I'm on Ubuntu – but it's the same on Debian. I'm using tcpdump in order to track the connection of computers on my private network. At some point, the internet connection of the computers launching ...
1
vote
0answers
445 views

latency measurement on Linux-based router using tcpdump

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
2
votes
2answers
1k views

Why can't I see other computers' traffic in the output of tcpdump?

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet. It is only when I begin to use internet by visiting a website ...
0
votes
2answers
2k views

Is there a tool to decrypt all SSL/SSH traffic originating from this computer?

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with ...
1
vote
2answers
676 views

How can I monitor which applications make DNS requests on OS X?

I'm trying to send all of my unencrypted day-to-day traffic over an SSH tunnel, which is working pretty well with a simple SOCKS proxy. Skype still goes outside, but that's okay, as Skype is ...
0
votes
2answers
205 views

Able to write on stdout but not in a file

I want to keep a trace of the URL I visit, so I use a command line like this: tcpdump -ien1 -v -X 'tcp port 80' | sed -nl 's/^.0x[0-9a-f]{4}:.{43}(.)$/\1/p' |perl break.pl |perl -pe ...
4
votes
1answer
2k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
1
vote
1answer
749 views

Log all http and https traffic that goes to the router in OSX

My router has ip 192.168.0.1. How can I log all the traffic it receives under http and https(port 443)? I think using tcpdump should do the trick but I'm not sure how to run it
2
votes
2answers
2k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
4
votes
2answers
6k views

How to make tcpdump (or other tool) to actually dump TCP stream?

I expect something like this: $ nc example.com 80 GET / HTTP/1.0 HTTP/1.0 500 K.O. Content-Type: application/null Content-Length: -1 $ Meanwhile: # tcpdump -i eth0 --actually-dump-all-tcp ...
2
votes
4answers
964 views

capture local network traffic

I have a PS3 and I am going to capture the PS3 traffic. However, how can I capture it with wireshark? Because when I capture it, it only shows the traffic to my computer only. For example, PC ...
4
votes
4answers
5k views

How to capture last N seconds of packets using tcpdump

How can I capture the last N seconds of packets using tcpdump?
0
votes
3answers
1k views

Using nc (netcat) to emulate NTP server response

I want to test some security on an NTP client developed in-house and would like to use netcat to do it. I have packets captured with Wireshark from previous NTP exchanges that I tried to feed to the ...
6
votes
5answers
22k views

Practical Tcpdump examples? [closed]

I want to collect tcpdump examples, as many as possible! E.g.: how to filter FTP passwords on eth0; OR how to filter HTTP 404 errors, etc.
1
vote
1answer
6k views

How do I make tcpdump to write to file for each packet it captures?

I'm running the following version of tcpdump: tcpdump version 4.0.0 libpcap version 1.0.0 I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the ...
8
votes
1answer
5k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
5
votes
1answer
694 views

Linux interface stops receiving packets as seen by tcpdump

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN. There is an IP configured on eth1. eth0 is up but no IP is configured. This interface is used for sniffing with ...
1
vote
2answers
1k views

Count exchanged bytes per TCP connection

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually ...
0
votes
1answer
2k views

tcpdump not showing all packets? [duplicate]

Possible Duplicate: my tcpdump always filters packets? I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the ...
0
votes
1answer
304 views

my tcpdump always filters packets?

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just: ...
0
votes
1answer
1k views

tcpdump missing on Cygwin v1.7.7 for packet sniffing

I am trying to debug why my TCP packets are truncated. I see that only the first 24 bytes of each packet are showing up in my program. The 25th through 28th bytes are scrambled and all others after ...
4
votes
1answer
933 views

How to ssh in the face of huge (25 second) latency?

I need to create an ssh connection between two Linux machines running Centos v5 but the latency could be as high as 25 seconds. I find that if I test something approaching this configuration ...