Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm receiving IP packets using the SLIP protocol, and I'd like to pretty-print them similarly to how tcpdump does it. My program is able to decode the SLIP protocol and create a single string containing an IP packet if necessary.

I couldn't find any relevant tcpdump command-line flags except for -r. The file format is documented at , but it looks a bit too complicated.

Is there a Linux tool for pretty-printing raw IP packets?

share|improve this question

closed as off-topic by kce, Zoredache, MadHatter, Falcon Momot, Ward Oct 20 '13 at 5:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – kce, Zoredache, MadHatter, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

I would take a strong look a the source of tcpdump or wireshark. – Zoredache Oct 19 '13 at 1:29
I'm not sure the reason for closing this question is valid. @pts is asking how to save data to a standard, common file format used by a ton of products. Neither pcap nor pcap-ng are going to be obsolete any time soon. If anything it's a programming question and therefore a good candidate for moving to SO. – Gerald Combs Nov 20 '13 at 0:38
up vote 1 down vote accepted

The link above is for the pcapng, the next-generation pcap file format. It allows for wonderful features and a great deal of functionality but it's probably overkill for your needs.

Assuming you just want to log packets the original pcap file format should suit your neeeds and is easy to write: 24 bytes of global header information followed by a 16-byte header + packet data for each packet. Tcpdump (and Wireshark and everything else) will read it just fine. You can even (and arguably should) include the SLIP header.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.