Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I search for a way to limit or change the output format of tcpdump to print only tcp sequnce number, but i didnt find a way to do this. Can you please advice?

Running on Ubuntu. If there is no way to do this in tcpdump other ways to do this with some linux command is also good, but prefer a way to do this directly by tcpdump.

share|improve this question

1 Answer 1

up vote 2 down vote accepted
tcpdump -i eth0 -v | egrep -o 'seq [0-9]+(:[0-9]+)?|ack [0-9]+'

Using verbose mode, filter through grep to select seq and ack numbers.

For a more advanced solution, you can pass data on to the scapy library and write code to parse packets directly. The documentation may be a bit staggering if you're not used to network / byte programming, but the power is impressive.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.