commandline packet analyzer

learn more… | top users | synonyms

2
votes
2answers
367 views

tcpdump: how to get grepable output?

I am trying to troubleshoot an issue where I only have tcpdump available on an appliance. I want to use tcpdump to filter web traffic, and only display traffic containing certain strings. I do the ...
0
votes
2answers
22 views

Decompress logged GZIP binary data

In an effort to verify my app was sending back and forth with my server correctly, I had run tcpdump -w ~/capture.txt -s 0 port 80 on a server with proxy sitting in between to capture all ...
0
votes
2answers
439 views

miss /dev/bpf in freebsd

I'm using tcpdump in freebsd, and I got the following error: $ /usr/sbin/tcpdump -i bge0 tcpdump: (cannot open device) /dev/bpf: No such file or directory a few google search indicate that the ...
0
votes
2answers
205 views

Able to write on stdout but not in a file

I want to keep a trace of the URL I visit, so I use a command line like this: tcpdump -ien1 -v -X 'tcp port 80' | sed -nl 's/^.0x[0-9a-f]{4}:.{43}(.)$/\1/p' |perl break.pl |perl -pe ...
3
votes
1answer
168 views

How to output a simple network activity plot in console in Linux?

There's tload that plots load average. There's iftop that network usage as bars. How to do something like this: # tcpdump -i eth0 --plot 'host 1.2.3.4' 13:45:03 | | 0 in 0 ...
1
vote
1answer
970 views

have tcpdump show the 'conversation' as i would get from wireshark?

Is it possible to get the same output i would get from: tcpdump port 80 -w log.pcap wireshark log.pcap in wireshark Analyze > Follow TCP Stream and then in the bottom drop down Entire ...
0
votes
1answer
27 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
0
votes
1answer
251 views

Detect HTTP sessions using tcpdump

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
0
votes
1answer
29 views

Is there a way to limit number of packet captures with tcpflow?

I want to limit the number of captured packets, such as: tcpdump -c 20 I want to use tcpflow instead. Is this possible? The console throws a syntax error using tcpflow with the -c parameter. edit - ...
0
votes
1answer
615 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
0
votes
1answer
555 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
3
votes
0answers
41 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
1
vote
0answers
12 views

tcpdump - rotate capture files using -G -W and -C

I'm looking to be able to capture a rotating tcpdump output which captures 30-minutes worth of data, into 48 files, cyclically. The man implies this should be possible, but my testing doesn't seem to ...
1
vote
0answers
59 views

how to capture “DROP”ped packets on OUTPUT of iptables?

having a fairly complex OUTPUT processing on iptables, how does one go about capturing / displaying (at least similarly to how tcpdump captures them) the packets that were to leave through an ...
1
vote
0answers
64 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
1
vote
0answers
130 views

What's wrong with this tcpdump syntax?

sudo tcpdump -i ath1 -s 0 -nne "(type mgt and subtype beacon)" Can anyone help me? I was following a tutorial at http://wiki.secarmour.com/2013/09/capture-wireless-traffic.html but seems I got ...
1
vote
0answers
295 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
0answers
143 views

No response received from github ssh randomly

My git pull started to stop working randomly with this error $ git pull ssh: connect to host github.com port 22: Connection timed out fatal: The remote end hung up unexpectedly I tried debugging ...
1
vote
0answers
163 views

tcpdump loses connection

I'm on Ubuntu – but it's the same on Debian. I'm using tcpdump in order to track the connection of computers on my private network. At some point, the internet connection of the computers launching ...
1
vote
0answers
445 views

latency measurement on Linux-based router using tcpdump

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
0
votes
0answers
14 views

UDP traceroute delay?

We are seeing timeout packages when running traceroute command between two Linux systems on a private network. However, we do not see such symptoms using TCP or ICMP over traceroute. This is a private ...
0
votes
0answers
16 views

ICMP flood with ping working only one time

my problem is simple: The first time I made a flooding ping to a fake ip on my network (for testing if someone is on promisc mode), it works perfectly: $ping -f 192.168.1.10 After perfoming this, ...
0
votes
0answers
28 views

How do I troubleshoot if I see the incoming packet in tcpdump, but not at the socket?

For example, I see that the incoming packet in tcpdump, but not in strace for the program that is listening the appopriate socket. How do I trace the "fate" of this incoming packet on Linux? I ...
0
votes
0answers
12 views

tcptrace from wireshark capture

How can I use tcptrace to generate tcptrace graph from captures on wireshark ? I already know how to generate the tcptrace on wireshark itself, but I want to generate the graph outside wireshark ...
0
votes
0answers
19 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
0
votes
0answers
659 views

Executing tcpdump remotely while storing packet capture locally

I have run into stumbling block while attempting to create a bash script that will write packet capture files from tcpdump onto a remote server, while displaying the output of the tcpdump command so ...