Hot answers tagged

34

tcpdump prints complete packets. "Garbage" you see are actually TCP package headers. you can certainly massage the output with i.e. a perl script, but why not use tshark, the textual version of wireshark instead? tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' it takes the same arguments as tcpdump (...


15

take a look at ngrep - it mighe be of some use for you. as reference for others httpry [ server seems to be down now but i hope it's temporary ] and tshark are also useful for passive protocol analysis - first one just for http, second - for much more.


9

You could use iptables. If you're not already using it, you can use an open Accept configuration, but have a rule in place to do the counting. For example, on RHEL your /etc/sysconfig/iptables file could look something like: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A FORWARD -j INPUT -A INPUT -s 10.10.1.1 -p tcp -m tcp --...


6

You would need to filter queries where the QTYPE is * (also known as ANY) (represented by the integer 255): In WireShark or NetMon this would be "dns.qry.type==255" So for tshark I assume it would be: "dns.qry.type eq 255" You can find the numerical values for all query types in RFC 1035 ยง3.2.3 "QTYPE Values"


6

There is also a tool called 'iftop' which displays bandwidth usage on an interface by host. I think iftop can do what you described but normally its interface is something like 'top'. So for your example, I think that you can just create config file to provide your filter-code. So here is my filter-code in my config file. $ cat /tmp/conf filter-code: port ...


5

Try httpry or justniffer Justniffer works well on tcp packets reordering retrasmissions and ip fragmentation


4

To expand on Niall's answer, you might try tshark -r <capture file> -q -z conv,ip The -q disables normal output and -z conv,ip dumps the IP conversation data. More information can be found in the man page and in Sake Blok's Sharkfest presentation.


4

Like this. tshark -nn -i <interface> -s 0 -w mycapture.pcap <hostname> and port <portnumber> Replace <interface> with the interface name to capture on (e.g., eth0). Replace <hostname> with the name or IP address of the remote host you want to capture packets for. Replace <portnumber> with the port the service is running ...


4

Just use tshark to output only the field in question by adding -Tfields -e ip.dst_host to your command line: tshark -i eth1 -Tfields -e ip.dst_host -f "net 1.2.3.4 and src port 2000" To get only the first occurrence, gather only a small number of packets and pass through head: tshark -i eth1 -Tfields -e ip.dst_host -f "net 1.2.3.4 and src port 2000" -c ...


3

I was about to suggest wireshark (for it's many 'conversation' features), but it is not a command-line tool. You could try tshark though, which is a command-line analyzer tool that is closes to wireshark. The output should have (somewhat) what you're looking for (example below): tshark -R "ip.addr == 10.2.3.67" -z conv,ip -p -f "tcp port 22" Result: ...


3

Assuming you already know how to use filters with tshark, just supply the following display filter: ssl.handshake.type == 1 If you want all ssl traffic, simply put ssl as the filter. You cannot use these directly in the capture filters as the capture filtering mechanism doesn't know if the payload is ssl or not. Alternatively, if you know what port the ...


3

Both tshark and tcpdump use the pcap library, so the capture filters use pcap-filter syntax. The filter you want is, as @tristan says, "not port 22". You can enter this as a quoted string argument to the -f option, or as an unquoted argument to the command. The following commands are equivalent: # tshark -f "not port 22" # tshark -- not port 22 The reason ...


3

For normal ethernet, your snaplen (-s option) should be 1500 if you want the entire packet. That'll give you the entire packet, and allow full protocol decodes when loaded up into WireShark itself. Depending on what you're sniffing, you'll probably want to increase your filesize as well. To get at least the headers of most packets, a snaplen of 200 is ...


3

You can also try "iptraf" it's lightweight and simple. It can filter by port and gives you high level info, no payload data, etc.


3

You likely created a loop. packet captured -> output to shell -> packets generated from that output -> back to packet capture Output to a file quietly (raw) or tshark -q -f "tcp port 22" -w test.raw as text by redirecting the output. tshark -f "tcp port 22" > test.txt


2

There is a small tool called pcaputil - it is part of the pjsip project. It should be able to decode pcap files with RTP (G.711, G.722, speex and other codecs are supported) into wav files. Compile pjsip and find pcaputil inside pjsip-apps/bin/samples/[architecture]/.


2

I don't have access to a tshark installation currently, but assuming that it's the same as the tcpdump: sudo tcpdump not port 22 so, potentially: tshark not port 22


2

Try tshark -r file.pcap -R "frame.number == n" Hope this was helpful.


2

awk can sum up a column of numbers. Something like this should do the trick. Assuming that the output of your tshark is in foo.txt: $ cat foo.txt | awk '{ sum += $3 } END { print sum }' You could also pipe the output of "grep" directly to awk, and it would work in a similar fashion.


2

You'll need to use a tool that's capable of replaying pcap files. No special trick to it. An example would tcpreplay. A simple search for "replay pcap file" will turn up even more tools gloriously up to date within the very second that you hit enter in your search engine of choice.


2

I wanted to capture some SNMP traps and keep them to test my application later. So I don't want to generate traps each time I wanted to test my application. I would like to post how I have done this. Hope this may help someone. 1) Capturing one packet with destination host 192.168.159.149 and port 1620 and saving it to a file tcpdump -n -c 1 -s 0 dst host ...


1

I was looking into the same problem just now .. I don't know if you found your solution, but I end up using a linux bash script to solve this problem .. below is the script .. #!/bin/bash FILENO=300 COUNTER=0 while [ $COUNTER -lt $FILENO ]; do sudo tshark -i any -a duration:300 -a filesize:500000 -w - | gzip -9 -f > TRACE/trace_$COUNTER.gzip ...


1

Work in progress: tshark -r $BIGFILE -T fields -e rpc.xid -R "nfs.fh.hash == 0x5c191ad8" | \ tshark -r $BIGFILE -R "$(\ python -c 'import sys; xids = sys.stdin.readlines(); print("||".join(["rpc.xid=={0}".format(xid.strip()) for xid in xids]))'\ )"


1

With tshark -r nfs.pcap -R 'nfs.fh.hash == 0x5c191ad8' you can get all requests or reply with fh. For more complicated cases I guess you need to write some code. There is a great tool for that http://git.linux-nfs.org/?p=mora/nfstest.git;a=summary


1

There is a command line component to wireshark called tshark which would do what you need. There's better instruction available here. Unfortunately, endpoints seem to be only available in the GUI. Another alternative might be to use X Forwarding to run Wireshark at the far side and forward the GUI to your local desktop. Without knowing what OS you're using ...


1

On CentOS they're all compiled into /usr/lib/libwireshark.so All of the filters are called dissectors within the source code and are located in epan/dissectors. The MySQL dissector is epan/dissectors/packet-mysql.c


1

Just use your low-end box with tcpdump, tshark or wireshark (the console version) and save the output to a file. Then download that file to your powerful desktop and load it up to wireshark GUI version.


1

It is saving to the pcap format, read it with tshark, wireshark, tcpdump, etc. To read a file with tshark do a tshark -r filename.


1

See tool for splitting pcap files by TCP connection?, then feel a bit sad that I can't find anything for Linux that will keep a PCAP in proper form and filter by flow. If you can do it without focusing on the flows, then tshark will respect all the normal tcpdump (pdf link) filters. Read in the dump and set the -w output flag and filters and you'll get your ...



Only top voted, non community-wiki answers of a minimum length are eligible