Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to use tcpdump on the DEFCON packets.

Here's the command I'm using:

tcpdump -qns 0 -X -r ulogd.eth0.pcap

And here's the output I'm getting:

10:39:12.356410 IP 192.168.103.2.3101 > 192.168.102.2.80: tcp 0
    0x0000:  4500 0028 0557 4000 7f06 a823 c0a8 6702  E..(.W@....#..g.
    0x0010:  c0a8 6602 0c1d 0050 2463 0fbe 8854 e419  ..f....P$c...T..
    0x0020:  5010 4296 71ec 0000                      P.B.q...
10:39:27.223199 IP 192.168.103.2.3101 > 192.168.102.2.80: tcp 52
    0x0000:  4500 005c 055e 4000 7f06 a7e8 c0a8 6702  E..\.^@.......g.
    0x0010:  c0a8 6602 0c1d 0050 2463 0fbe 8854 e419  ..f....P$c...T..
    0x0020:  5018 4296 0d82 0000 4745 5420 2f2f 726f  P.B.....GET.//ro
    0x0030:  756e 6431 3832 2e78 6d6c 2048 5454 502f  und182.xml.HTTP/
    0x0040:  312e 310d 0a48 6f73 743a 2031 3932 2e31  1.1..Host:.192.1
    0x0050:  3638 2e31 3032 2e32 0d0a 0d0a            68.102.2....
10:39:27.224154 IP 192.168.102.2.80 > 192.168.103.2.3101: tcp 474
    0x0000:  4500 0202 90d3 4000 3f06 5acd c0a8 6602  E.....@.?.Z...f.
    0x0010:  c0a8 6702 0050 0c1d 8854 e419 2463 0ff2  ..g..P...T..$c..
    0x0020:  5018 16d0 6b2f 0000 4854 5450 2f31 2e31  P...k/..HTTP/1.1
    0x0030:  2034 3034 204e 6f74 2046 6f75 6e64 0d0a  .404.Not.Found..
    0x0040:  4461 7465 3a20 4d6f 6e2c 2030 3420 4175  Date:.Mon,.04.Au
    0x0050:  6720 3230 3033 2030 393a 3339 3a32 3720  g.2003.09:39:27.
    0x0060:  474d 540d 0a53 6572 7665 723a 2041 7061  GMT..Server:.Apa
    0x0070:  6368 652f 312e 332e 3236 2028 556e 6978  che/1.3.26.(Unix
    0x0080:  2920 4465 6269 616e 2047 4e55 2f4c 696e  ).Debian.GNU/Lin
    0x0090:  7578 0d0a 5472 616e 7366 6572 2d45 6e63  ux..Transfer-Enc
    0x00a0:  6f64 696e 673a 2063 6875 6e6b 6564 0d0a  oding:.chunked..
    0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465  Content-Type:.te
    0x00c0:  7874 2f68 746d 6c3b 2063 6861 7273 6574  xt/html;.charset
    0x00d0:  3d69 736f 2d38 3835 392d 310d 0a0d 0a31  =iso-8859-1....1
    0x00e0:  3137 0d0a 3c21 444f 4354 5950 4520 4854  17..<!DOCTYPE.HT
    0x00f0:  4d4c 2050 5542 4c49 4320 222d 2f2f 4945  ML.PUBLIC."-//IE
    0x0100:  5446 2f2f 4454 4420 4854 4d4c 2032 2e30  TF//DTD.HTML.2.0
    0x0110:  2f2f 454e 223e 0a3c 4854 4d4c 3e3c 4845  //EN">.<HTML><HE
    0x0120:  4144 3e0a 3c54 4954 4c45 3e34 3034 204e  AD>.<TITLE>404.N
    0x0130:  6f74 2046 6f75 6e64 3c2f 5449 544c 453e  ot.Found</TITLE>
    0x0140:  0a3c 2f48 4541 443e 3c42 4f44 593e 0a3c  .</HEAD><BODY>.<
    0x0150:  4831 3e4e 6f74 2046 6f75 6e64 3c2f 4831  H1>Not.Found</H1
    0x0160:  3e0a 5468 6520 7265 7175 6573 7465 6420  >.The.requested.
    0x0170:  5552 4c20 2f2f 726f 756e 6431 3832 2e78  URL.//round182.x
    0x0180:  6d6c 2077 6173 206e 6f74 2066 6f75 6e64  ml.was.not.found
    0x0190:  206f 6e20 7468 6973 2073 6572 7665 722e  .on.this.server.
    0x01a0:  3c50 3e0a 3c48 523e 0a3c 4144 4452 4553  <P>.<HR>.<ADDRES
    0x01b0:  533e 4170 6163 6865 2f31 2e33 2e32 3620  S>Apache/1.3.26.
    0x01c0:  5365 7276 6572 2061 7420 7363 6f72 652e  Server.at.score.
    0x01d0:  726f 6f74 6675 2e6a 7020 506f 7274 2038  rootfu.jp.Port.8
    0x01e0:  303c 2f41 4444 5245 5353 3e0a 3c2f 424f  0</ADDRESS>.</BO
    0x01f0:  4459 3e3c 2f48 544d 4c3e 0a0d 0a30 0d0a  DY></HTML>...0..
    0x0200:  0d0a                                     ..
10:39:27.406315 IP 192.168.103.2.3101 > 192.168.102.2.80: tcp 0
    0x0000:  4500 0028 055f 4000 7f06 a81b c0a8 6702  E..(._@.......g.
    0x0010:  c0a8 6602 0c1d 0050 2463 0ff2 8854 e5f3  ..f....P$c...T..
    0x0020:  5010 40bc 71b8 0000                      P.@.q...

I'm not interested in the stuff to the left (hex representations and the IP addresses). I just want the content. Also, what are all those dots?

share|improve this question

2 Answers 2

Some nice alternatives to the -A switch womble pointed out:

tcpflow will read a pcap file and split the TCP connections into separate files. Make sure you use a temp directory as it will split it into separate files for each connection.

tcpdump -s0 -w capfile
...
mkdir tmp && cd tmp
tcpflow -r ../capfile

You can also get something from tcpflow very similar to tcpdump -A, without splitting to different files:

tcpflow -C -r capfile

Personally, I find using wireshark and its Follow TCP stream option the easiest to read as it color-codes each side of the conversation. You can capture with wireshark directly or read captures made with tcpdump.

share|improve this answer
    
Hey, thanks for the reply. I'm trying to match the DEFCON dataset with a list of 1500 strings. I need to parse the .pcap file so I can match against the 1500 strings! Have you any idea how I might do this? –  Eamorr Jul 15 '11 at 12:55
    
Look at ngrep, or print packets in ASCII and use regular ol' grep. –  Cakemox Jul 15 '11 at 13:29

The dots are non-printable characters; anything outside of the range ASCII 32-126 (or thereabouts). You're getting the hexdump representation because you used the -X option; if you instead use the -A option, you'll get just the ASCII representation.

share|improve this answer
    
Hey, thanks for the reply –  Eamorr Jul 15 '11 at 12:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.