Tcpdump howto - Revision history

Nighthawk: /* reading tcpdump captures */

2016-01-28T21:03:44Z

‎reading tcpdump captures

Nighthawk at 16:15, 7 November 2014

2014-11-07T16:15:59Z

Nighthawk at 16:15, 7 November 2014

2014-11-07T16:15:21Z

Nighthawk at 19:44, 28 April 2014

2014-04-28T19:44:35Z

Nighthawk at 19:28, 28 April 2014

2014-04-28T19:28:19Z

Nighthawk at 19:23, 28 April 2014

2014-04-28T19:23:33Z

Nighthawk at 18:30, 24 July 2013

2013-07-24T18:30:08Z

Nighthawk: Pushed from Themanclub.

2013-04-12T16:42:02Z

Pushed from Themanclub.

New page

[[Changing packet size in the capture file:]]

By default, when capturing packets into a file, it will save only 68 bytes of the data from each packet. The -s command line switch tells tcpdump how many bytes for each packet to save. Specifying 0 as a packet’s snapshot length tells tcpdump to save whole packet.

example:
'''tcpdump -w file.cap -s 0'''

UNIX tcpdump 3.9.4(Freebsd, ipso)

== Showing link level headers (MAC addresses) ==
tcpdump -e -i ethxxx

== filtering for specific sources and destinations ==
tcpdump -nnei eth1-01 '((host 192.168.1.1 and host 172.16.0.1) or (host 10.0.0.1 and host 172.16.0.1))'

[[Category:Linux]]

← Older revision		Revision as of 21:03, 28 January 2016
Line 47:		Line 47:
	-XX		-XX

		+	show absolute (not relative) sequence numbers
		+	-S or --absolute-tcp-sequence-numbers

	[[Category:Linux]]		[[Category:Linux]]

← Older revision		Revision as of 16:15, 7 November 2014
Line 22:		Line 22:

	'''filtering based on TCP flags'''		'''filtering based on TCP flags'''
		+
		+	filter for packets with RST flag set
	tcpdump -nnei eth0 'tcp[tcpflags] & tcp-rst != 0'		tcpdump -nnei eth0 'tcp[tcpflags] & tcp-rst != 0'

← Older revision		Revision as of 16:15, 7 November 2014
Line 20:		Line 20:
	'''filtering for specific sources and destinations'''		'''filtering for specific sources and destinations'''
	tcpdump -nnei eth1-01 '((host 192.168.1.1 and host 172.16.0.1) or (host 10.0.0.1 and host 172.16.0.1))'		tcpdump -nnei eth1-01 '((host 192.168.1.1 and host 172.16.0.1) or (host 10.0.0.1 and host 172.16.0.1))'
		+
		+	'''filtering based on TCP flags'''
		+	tcpdump -nnei eth0 'tcp[tcpflags] & tcp-rst != 0'

← Older revision		Revision as of 19:44, 28 April 2014
Line 27:		Line 27:

	default location /var/lib/tcpdump/		default location /var/lib/tcpdump/
		+
		+
		+	== reading tcpdump captures ==
		+
		+	It is a pain sometimes to transfer tcpdump to another device for viewing in Wireshark or other utilities. The same filters that apply to capturing can be applied to reading the tcpdump capture file.
		+
		+	# tcpdump -r <path to file>
		+
		+	showing the data portion of a packet
		+
		+	# tcpdump -X -r <path to file>
		+
		+	double X will also display the link level headers
		+	-XX


	[[Category:Linux]]		[[Category:Linux]]

@@ Line 14: / Line 14: @@
-== Showing link level headers (MAC addresses) ==
+'''Showing link level headers (MAC addresses)'''
    tcpdump -e -i ethxxx
-== filtering for specific sources and destinations ==
+'''filtering for specific sources and destinations'''
    tcpdump -nnei eth1-01 '((host 192.168.1.1 and host 172.16.0.1) or (host 10.0.0.1 and host 172.16.0.1))'
-== gentoo output file ==
+'''gentoo output file'''
   default location /var/lib/tcpdump/
 [[Category:Linux]]

← Older revision		Revision as of 19:23, 28 April 2014
Line 1:		Line 1:
−	[[Changing packet size in the capture file:]]	+
		+	== capturing ==
		+
		+
		+	Changing packet size in the capture file:

	By default, when capturing packets into a file, it will save only 68 bytes of the data from each packet. The -s command line switch tells tcpdump how many bytes for each packet to save. Specifying 0 as a packet’s snapshot length tells tcpdump to save whole packet.		By default, when capturing packets into a file, it will save only 68 bytes of the data from each packet. The -s command line switch tells tcpdump how many bytes for each packet to save. Specifying 0 as a packet’s snapshot length tells tcpdump to save whole packet.