How do I make tcpdump not print the tcp headers?

Question

I tried this:

tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'

I need only the ascii part of it. How do I remove the rest?

Answer 1

I'm not sure about the exact syntax for tcpdump... in fact, I have marked this question as a favorite because I would like to know! But as an alternative solution, you could try using tcpflow instead. It works essentially the same way, but it prints ASCII output much better; it excluded the headers and prints packets sequentially as a flow, so it's easier to read and follow at times than tcpdump.

Answer 2

A quick and dirty way to do this is to filter the output through strings:

tcpdump -nli eth0 '(port 6667) and (length > 74)' -s 0 -w - | strings

Sometimes you don't have other tools and for a quick peek into the payload this is enough. It's no good if you need the exact payload for injection or an exact analysis, of course.

Answer 3

If you need only the ASCII part you can use: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'|sed 's/\.//g' or with ngrep: ngrep -d eth0 -lq . '(port 6667) and (length > 74)' |sed -rn '/^ /s/\.//gp'

Answer 4

I had the same problem last week - I used the wireshark gui instead and did a "copy readable ascii" for the interesting packets.

I was (successfully) trying to pin down a problem with a http request to a web-service and its XML-answer.