Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tried this:

tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'

I need only the ascii part of it. How do I remove the rest?

share|improve this question
with tshark you can do it with: tshark -l -i eth0 -f 'port 6667 and greater 74' -T field -e data – Marcin Nov 28 '10 at 17:02
It says 28 packets captured but doesn't print anything to STDOUT. – coder Nov 29 '10 at 16:47
Do you mean ASCII7? – Mircea Vutcovici Apr 14 '11 at 16:05

As Josh suggests, tcpflow can print just the TCP packet data to a file or STDOUT. You can pipe tcpdump to tcpflow like this:

tcpdump -i lo -l -w - port 23 | tcpflow -C -r -

To only view one side of the conversation, you can use filters for tcpdump, e.g. dst port 23.

share|improve this answer
Why would you need to start tcpflow as root? – Ruslan Mar 13 '14 at 8:56

I'm not sure about the exact syntax for tcpdump... in fact, I have marked this question as a favorite because I would like to know! But as an alternative solution, you could try using tcpflow instead. It works essentially the same way, but it prints ASCII output much better; it excluded the headers and prints packets sequentially as a flow, so it's easier to read and follow at times than tcpdump.

share|improve this answer

A quick and dirty way to do this is to filter the output through strings:

tcpdump -nli eth0 '(port 6667) and (length > 74)' -s 0 -w - | strings

Sometimes you don't have other tools and for a quick peek into the payload this is enough. It's no good if you need the exact payload for injection or an exact analysis, of course.

share|improve this answer

If you need only the ASCII part you can use: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'|sed 's/\.//g' or with ngrep: ngrep -d eth0 -lq . '(port 6667) and (length > 74)' |sed -rn '/^ /s/\.//gp'

share|improve this answer

I had the same problem last week - I used the wireshark gui instead and did a "copy readable ascii" for the interesting packets.

I was (successfully) trying to pin down a problem with a http request to a web-service and its XML-answer.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.