commandline packet analyzer

learn more… | top users | synonyms

27
votes
3answers
21k views

Can I monitor a local unix domain socket like tcpdump?

I'd like to monitor responses on a unix socket without disturbing the original connections and pipe them to a script for processing. I know how to do this with tcpdump for tcp connections but I ...
10
votes
4answers
20k views

how to make tcpdump to display ip and port number but not hostname and protocol

I'm using tcpdump for some tests I want to see the IP and port number but the output of tcpdump is like IP pl1snu.koren.kr.http > kitch.pl.sophia.inria.fr.dnp: Flags [P.], seq 54:72, ack 1, win ...
9
votes
2answers
105k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
9
votes
2answers
6k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
6
votes
4answers
9k views

How to capture last N seconds of packets using tcpdump

How can I capture the last N seconds of packets using tcpdump?
6
votes
5answers
26k views

Practical Tcpdump examples? [closed]

I want to collect tcpdump examples, as many as possible! E.g.: how to filter FTP passwords on eth0; OR how to filter HTTP 404 errors, etc.
6
votes
1answer
3k views

Traffic between VirtualBox guests not showing up in tcpdump

I have a test environment setup with 4 VirtualBox guests running CentOS 6. Each has one network device attached to a bridged adapter, which is my primary network connection on my PC, with a static IP ...
5
votes
3answers
5k views

tcpdump: how to get grepable output?

I am trying to troubleshoot an issue where I only have tcpdump available on an appliance. I want to use tcpdump to filter web traffic, and only display traffic containing certain strings. I do the ...
5
votes
2answers
11k views

tcpdump promiscuous mode on OSX 10.8

By examining my wireless router configuration I can see there's 2 IPs assigned: 192.168.1.100 -> laptop (Macbook Air OSX 10.8.2, where I runtcpdump) 192.168.1.101 -> ipad But then if I run: sudo ...
5
votes
1answer
975 views

Linux interface stops receiving packets as seen by tcpdump

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN. There is an IP configured on eth1. eth0 is up but no IP is configured. This interface is used for sniffing with ...
4
votes
2answers
9k views

How to make tcpdump (or other tool) to actually dump TCP stream?

I expect something like this: $ nc example.com 80 GET / HTTP/1.0 HTTP/1.0 500 K.O. Content-Type: application/null Content-Length: -1 $ Meanwhile: # tcpdump -i eth0 --actually-dump-all-tcp 217.21....
4
votes
1answer
451 views

understanding the tcp header

The first 16 bits in a tcp header, (rfc793), are for the source port, right? The next 16 are for the destination port. When I run tcpdump -xx I can recognise MAC addresses of boxes on my system. Does ...
4
votes
1answer
3k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
4
votes
1answer
1k views

How to ssh in the face of huge (25 second) latency?

I need to create an ssh connection between two Linux machines running Centos v5 but the latency could be as high as 25 seconds. I find that if I test something approaching this configuration ...
4
votes
0answers
267 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
3
votes
2answers
716 views

Filter packets sent via HTTP to a port other then 80?

I have a database communicating on port 7474 via HTTP (sigh), and I want to debug the queries sent to / from it. However, a filter such as http.request.method == "POST" Filters out every post ...
3
votes
2answers
3k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
3
votes
1answer
864 views

Using tcpdump on displayed TCP data

If sudo tcpdump -i eth0 -X gives me tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 16:16:11....
3
votes
1answer
198 views

How to output a simple network activity plot in console in Linux?

There's tload that plots load average. There's iftop that network usage as bars. How to do something like this: # tcpdump -i eth0 --plot 'host 1.2.3.4' 13:45:03 | | 0 in 0 ...
2
votes
2answers
8k views

tcpdump error: no suitable device found in Linux

Guys im trying to test a tcpdump to google.com (im new to Linux by the way). so here's what i typed in my shell: $tcpdump src 192.168.1.xxx and dst www.google.com and port ftp but i get this error:...
2
votes
2answers
629 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
2
votes
2answers
2k views

Why can't I see other computers' traffic in the output of tcpdump?

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet. It is only when I begin to use internet by visiting a website ...
2
votes
2answers
601 views

Is there a serious issue with setting the SUID bit on tcpdump?

I'm running tcpdump on a remote machine, and piping the output to Wireshark on my local machine over SSH. In order to do this, I had to set the SUID bit on tcpdump. For background, the remote machine ...
2
votes
1answer
3k views

tcpdump - rotate capture files using -G -W and -C

I'm looking to be able to capture a rotating tcpdump output which captures 30-minutes worth of data, into 48 files, cyclically. The man implies this should be possible, but my testing doesn't seem to ...
2
votes
1answer
2k views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
2
votes
1answer
242 views

what does `tcpdump -xx` do in Mac OS X?

I was playing with tcpdump, and I noticed that, on OS X, the -xx option does something that is different to what the man page describes. Here is what the man page says: -x When parsing and ...
2
votes
1answer
190 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In B,...
2
votes
4answers
1k views

capture local network traffic

I have a PS3 and I am going to capture the PS3 traffic. However, how can I capture it with wireshark? Because when I capture it, it only shows the traffic to my computer only. For example, PC 192....
1
vote
3answers
1k views

Check if HTTP calls are gzipped

Assuming that I have an application server (Linux) running on port 80, how can I make sure (with tcpdump, I guess) that all incoming requests are gzipped and all responses are gzipped as well? Also, ...
1
vote
1answer
2k views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
1
vote
2answers
27 views

tcpdump is not capturing packets

Can anybody tell me what kind of error I have in this? It isn't reading any packets when I run it. nohup sudo tcpdump -i any host 10.0.1.107 and port 5060 and port 6060 -G 010 -W 015 -w capture_%Y-%m-...
1
vote
1answer
30 views

How many ARP Request/Reply for Ping command to work

I would like know how many ARP Request/Reply are required for ping command to get work ? Let's say we have two machines connected point to point with ip's 192.168.110.2 and 192.168.110.3 and executes ...
1
vote
2answers
371 views

How to find IP address of ADSL modem?

Our fall back Internet connection uses a SpeedStream 4100 modem, which just broke, so I have replaced it with a new one. I need to configure it to bridge mode, but I can't even find its IP address. ...
1
vote
1answer
1k views

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?

I am on server 192.168.0.2 and want to make a HTTP call to 192.168.0.1(both servers are RPis and run Linux (raspbian)). curl -XGET http://192.168.0.1:8081/api The API on 192.168.0.1 (which I am ...
1
vote
1answer
889 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
1
vote
2answers
86 views

Can tcpdump be instructed not to report packets to a specific source?

I would like to monitor packets using TCPdump. Sadly, I must do this remotely - in this case, I'm using a remote desktop from VNC, but at best I can do it over SSH. What I mean by "at best" is: I am ...
1
vote
2answers
1k views

How to quieten tcpdump output when reading a pcap file?

I notice that when using tcpdump to read a pcap file, the tcpdump command somehow manages to print information to my console even when I redirect both STDOUT and STDERR. How can I prevent tcpdump from ...
1
vote
2answers
504 views

Different packet sizes on Wi-Fi and 3G interfaces while tethering

I am using an application called android-wifi-tether on a mobile phone. My laptop is connected to the phone over Wi-Fi and the phone is connected to Internet over 3G. I am using tcpdump to sniff ...
1
vote
1answer
3k views

How to set NIC in promiscuous mode on mac book air?

I am trying to run my nic on MacOSx at promiscuous mode and then use tshark / tcpdump Option1: ifconfig en0 promisc but I get this message: ifconfig: promisc: bad value Option 2: I tried sudo ...
1
vote
1answer
8k views

How do I make tcpdump to write to file for each packet it captures?

I'm running the following version of tcpdump: tcpdump version 4.0.0 libpcap version 1.0.0 I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the ...
1
vote
1answer
132 views

Wireless packet sniffing on Linux. Captured data is almost only broadcasts

Environment: Home network that operates on channel 8 (I am the admin so all the passwords are known and I have physical access to all devices), with a PC and a laptop connected to it (both standing ...
1
vote
1answer
731 views

Check for packets MARKed by iptables

I am marking TCP and UDP packets in order to send them to two different interfaces (say wlan0 and eth0), I did this by following this answer. Assuming this configuration: eth0 address: 192.168.0.84 ...
1
vote
1answer
380 views

How to detect packets that are only from the local network and not from the ISP/internet?

I'm building a bandwidth monitor using JNetPcap(java version of libpcap/winpcap). I need to recognise packets within the home network so that I don' count them towards the total bandwidth used. I ...
1
vote
1answer
572 views

What does this tcpdump printout mean?

I'm not very experience with networking, so on my free time, I usually try and learn some more things about the internet and how it works. While at school, I came across tcpdump and wanted to give it ...
1
vote
1answer
2k views

TCPDUMP -G option

Can anyone give me examples of the TCPDUMP -G use with 60 seconds as a example and incremental files? like : tcpdump -w %s -G 60 i try it but don't increment files only reset the file each ...
1
vote
1answer
812 views

Log all http and https traffic that goes to the router in OSX

My router has ip 192.168.0.1. How can I log all the traffic it receives under http and https(port 443)? I think using tcpdump should do the trick but I'm not sure how to run it
1
vote
2answers
2k views

Count exchanged bytes per TCP connection

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually all)...
1
vote
1answer
2k views

tcpdump missing on Cygwin v1.7.7 for packet sniffing

I am trying to debug why my TCP packets are truncated. I see that only the first 24 bytes of each packet are showing up in my program. The 25th through 28th bytes are scrambled and all others after ...
1
vote
0answers
14 views

how to capture a certain http code responce with tcpdump

I want to capture http errors on openwrt. ngrep utility would be very useful but is not available there also tshark is not available also. so it leaves me with tcpdump. how do I tell tcpdump to ...
1
vote
1answer
65 views

What is a cache flush, and how do you explain this TCPdump pattern?

I ran TCPdump a few times on my home network and found a lot of packets that were marked (Cache Flush), seemingly originating with my sister's laptop. I can't see any HTTP or HTTPS packets during the ...