commandline packet analyzer

learn more… | top users | synonyms

18
votes
3answers
13k views

Can I monitor a local unix domain socket like tcpdump?

I'd like to monitor responses on a unix socket without disturbing the original connections and pipe them to a script for processing. I know how to do this with tcpdump for tcp connections but I ...
8
votes
1answer
5k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
7
votes
3answers
63k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
6
votes
5answers
23k views

Practical Tcpdump examples? [closed]

I want to collect tcpdump examples, as many as possible! E.g.: how to filter FTP passwords on eth0; OR how to filter HTTP 404 errors, etc.
6
votes
1answer
2k views

Traffic between VirtualBox guests not showing up in tcpdump

I have a test environment setup with 4 VirtualBox guests running CentOS 6. Each has one network device attached to a bridged adapter, which is my primary network connection on my PC, with a static IP ...
5
votes
4answers
9k views

how to make tcpdump to display ip and port number but not hostname and protocol

I'm using tcpdump for some tests I want to see the IP and port number but the output of tcpdump is like IP pl1snu.koren.kr.http > kitch.pl.sophia.inria.fr.dnp: Flags [P.], seq 54:72, ack 1, win ...
5
votes
2answers
9k views

tcpdump promiscuous mode on OSX 10.8

By examining my wireless router configuration I can see there's 2 IPs assigned: 192.168.1.100 -> laptop (Macbook Air OSX 10.8.2, where I runtcpdump) 192.168.1.101 -> ipad But then if I run: sudo ...
5
votes
1answer
756 views

Linux interface stops receiving packets as seen by tcpdump

I have a linux box with two interfaces: eth0 is a builtin and eth1 is a USB-LAN. There is an IP configured on eth1. eth0 is up but no IP is configured. This interface is used for sniffing with ...
4
votes
2answers
7k views

How to make tcpdump (or other tool) to actually dump TCP stream?

I expect something like this: $ nc example.com 80 GET / HTTP/1.0 HTTP/1.0 500 K.O. Content-Type: application/null Content-Length: -1 $ Meanwhile: # tcpdump -i eth0 --actually-dump-all-tcp ...
4
votes
4answers
6k views

How to capture last N seconds of packets using tcpdump

How can I capture the last N seconds of packets using tcpdump?
4
votes
1answer
352 views

understanding the tcp header

The first 16 bits in a tcp header, (rfc793), are for the source port, right? The next 16 are for the destination port. When I run tcpdump -xx I can recognise MAC addresses of boxes on my system. Does ...
4
votes
1answer
2k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
4
votes
1answer
989 views

How to ssh in the face of huge (25 second) latency?

I need to create an ssh connection between two Linux machines running Centos v5 but the latency could be as high as 25 seconds. I find that if I test something approaching this configuration ...
4
votes
0answers
81 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
3
votes
2answers
502 views

Filter packets sent via HTTP to a port other then 80?

I have a database communicating on port 7474 via HTTP (sigh), and I want to debug the queries sent to / from it. However, a filter such as http.request.method == "POST" Filters out every post ...
3
votes
1answer
171 views

How to output a simple network activity plot in console in Linux?

There's tload that plots load average. There's iftop that network usage as bars. How to do something like this: # tcpdump -i eth0 --plot 'host 1.2.3.4' 13:45:03 | | 0 in 0 ...
2
votes
2answers
522 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
2
votes
2answers
5k views

tcpdump error: no suitable device found in Linux

Guys im trying to test a tcpdump to google.com (im new to Linux by the way). so here's what i typed in my shell: $tcpdump src 192.168.1.xxx and dst www.google.com and port ftp but i get this ...
2
votes
2answers
1k views

Why can't I see other computers' traffic in the output of tcpdump?

On LAN, when I use tcpdump on my eth0 interface to monitor packets, nothing happens although other computers are using the internet. It is only when I begin to use internet by visiting a website ...
2
votes
2answers
471 views

Is there a serious issue with setting the SUID bit on tcpdump?

I'm running tcpdump on a remote machine, and piping the output to Wireshark on my local machine over SSH. In order to do this, I had to set the SUID bit on tcpdump. For background, the remote machine ...
2
votes
1answer
1k views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
2
votes
2answers
2k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
2
votes
1answer
98 views

what does `tcpdump -xx` do in Mac OS X?

I was playing with tcpdump, and I noticed that, on OS X, the -xx option does something that is different to what the man page describes. Here is what the man page says: -x When parsing and ...
2
votes
1answer
137 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In ...
2
votes
4answers
996 views

capture local network traffic

I have a PS3 and I am going to capture the PS3 traffic. However, how can I capture it with wireshark? Because when I capture it, it only shows the traffic to my computer only. For example, PC ...
2
votes
1answer
621 views

Using tcpdump on displayed TCP data

If sudo tcpdump -i eth0 -X gives me tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes ...
2
votes
1answer
115 views

tcpdump - rotate capture files using -G -W and -C

I'm looking to be able to capture a rotating tcpdump output which captures 30-minutes worth of data, into 48 files, cyclically. The man implies this should be possible, but my testing doesn't seem to ...
2
votes
2answers
761 views

tcpdump: how to get grepable output?

I am trying to troubleshoot an issue where I only have tcpdump available on an appliance. I want to use tcpdump to filter web traffic, and only display traffic containing certain strings. I do the ...
1
vote
1answer
1k views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
1
vote
3answers
609 views

Check if HTTP calls are gzipped

Assuming that I have an application server (Linux) running on port 80, how can I make sure (with tcpdump, I guess) that all incoming requests are gzipped and all responses are gzipped as well? Also, ...
1
vote
2answers
49 views

How to find IP address of ADSL modem?

Our fall back Internet connection uses a SpeedStream 4100 modem, which just broke, so I have replaced it with a new one. I need to configure it to bridge mode, but I can't even find its IP address. ...
1
vote
2answers
637 views

How to quieten tcpdump output when reading a pcap file?

I notice that when using tcpdump to read a pcap file, the tcpdump command somehow manages to print information to my console even when I redirect both STDOUT and STDERR. How can I prevent tcpdump from ...
1
vote
1answer
181 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
1
vote
2answers
54 views

Can tcpdump be instructed not to report packets to a specific source?

I would like to monitor packets using TCPdump. Sadly, I must do this remotely - in this case, I'm using a remote desktop from VNC, but at best I can do it over SSH. What I mean by "at best" is: I am ...
1
vote
2answers
282 views

Different packet sizes on Wi-Fi and 3G interfaces while tethering

I am using an application called android-wifi-tether on a mobile phone. My laptop is connected to the phone over Wi-Fi and the phone is connected to Internet over 3G. I am using tcpdump to sniff ...
1
vote
1answer
2k views

How to set NIC in promiscuous mode on mac book air?

I am trying to run my nic on MacOSx at promiscuous mode and then use tshark / tcpdump Option1: ifconfig en0 promisc but I get this message: ifconfig: promisc: bad value Option 2: I tried sudo ...
1
vote
1answer
292 views

How to detect packets that are only from the local network and not from the ISP/internet?

I'm building a bandwidth monitor using JNetPcap(java version of libpcap/winpcap). I need to recognise packets within the home network so that I don' count them towards the total bandwidth used. I ...
1
vote
1answer
472 views

What does this tcpdump printout mean?

I'm not very experience with networking, so on my free time, I usually try and learn some more things about the internet and how it works. While at school, I came across tcpdump and wanted to give it ...
1
vote
1answer
1k views

TCPDUMP -G option

Can anyone give me examples of the TCPDUMP -G use with 60 seconds as a example and incremental files? like : tcpdump -w %s -G 60 i try it but don't increment files only reset the file each ...
1
vote
1answer
765 views

Log all http and https traffic that goes to the router in OSX

My router has ip 192.168.0.1. How can I log all the traffic it receives under http and https(port 443)? I think using tcpdump should do the trick but I'm not sure how to run it
1
vote
1answer
6k views

How do I make tcpdump to write to file for each packet it captures?

I'm running the following version of tcpdump: tcpdump version 4.0.0 libpcap version 1.0.0 I want to make tcpdump write to a file for each packet it captures. Currently, I could only see the ...
1
vote
2answers
1k views

Count exchanged bytes per TCP connection

I need to get a table updated with the exchanged bytes (Rx and/or Tx) for each ESTABLISHED TCP connection on a linux machine (well, at least, a list of connections (port ranges), thus not actually ...
1
vote
1answer
1k views

tcpdump missing on Cygwin v1.7.7 for packet sniffing

I am trying to debug why my TCP packets are truncated. I see that only the first 24 bytes of each packet are showing up in my program. The 25th through 28th bytes are scrambled and all others after ...
1
vote
0answers
34 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
1
vote
1answer
30 views

Unable to see broadcast packets with tcpdump

I am launching an application which broadcasts udp packets. I also have a simple python script to confirm that these packets are being broadcast: sock = socket.socket(socket.AF_INET, ...
1
vote
0answers
105 views

how to capture “DROP”ped packets on OUTPUT of iptables?

having a fairly complex OUTPUT processing on iptables, how does one go about capturing / displaying (at least similarly to how tcpdump captures them) the packets that were to leave through an ...
1
vote
0answers
92 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
1
vote
0answers
228 views

What's wrong with this tcpdump syntax?

sudo tcpdump -i ath1 -s 0 -nne "(type mgt and subtype beacon)" Can anyone help me? I was following a tutorial at http://wiki.secarmour.com/2013/09/capture-wireless-traffic.html but seems I got ...
1
vote
0answers
354 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
0answers
173 views

No response received from github ssh randomly

My git pull started to stop working randomly with this error $ git pull ssh: connect to host github.com port 22: Connection timed out fatal: The remote end hung up unexpectedly I tried debugging ...