Tag Info

Hot answers tagged

30

tcpdump prints complete packets. "Garbage" you see are actually TCP package headers. you can certainly massage the output with i.e. a perl script, but why not use tshark, the textual version of wireshark instead? tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' it takes the same arguments as tcpdump ...


13

take a look at ngrep - it mighe be of some use for you. as reference for others httpry [ server seems to be down now but i hope it's temporary ] and tshark are also useful for passive protocol analysis - first one just for http, second - for much more.


6

You could use iptables. If you're not already using it, you can use an open Accept configuration, but have a rule in place to do the counting. For example, on RHEL your /etc/sysconfig/iptables file could look something like: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A FORWARD -j INPUT -A INPUT -s 10.10.1.1 -p tcp -m tcp ...


6

You would need to filter queries where the QTYPE is * (also known as ANY) (represented by the integer 255): In WireShark or NetMon this would be "dns.qry.type==255" So for tshark I assume it would be: "dns.qry.type eq 255" You can find the numerical values for all query types in RFC 1035 ยง3.2.3 "QTYPE Values"


4

To expand on Niall's answer, you might try tshark -r <capture file> -q -z conv,ip The -q disables normal output and -z conv,ip dumps the IP conversation data. More information can be found in the man page and in Sake Blok's Sharkfest presentation.


4

Like this. tshark -nn -i <interface> -s 0 -w mycapture.pcap <hostname> and port <portnumber> Replace <interface> with the interface name to capture on (e.g., eth0). Replace <hostname> with the name or IP address of the remote host you want to capture packets for. Replace <portnumber> with the port the service is running ...


4

Just use tshark to output only the field in question by adding -Tfields -e ip.dst_host to your command line: tshark -i eth1 -Tfields -e ip.dst_host -f "net 1.2.3.4 and src port 2000" To get only the first occurrence, gather only a small number of packets and pass through head: tshark -i eth1 -Tfields -e ip.dst_host -f "net 1.2.3.4 and src port 2000" -c ...


4

Try httpry or justniffer Justniffer works well on tcp packets reordering retrasmissions and ip fragmentation


3

There is also a tool called 'iftop' which displays bandwidth usage on an interface by host. I think iftop can do what you described but normally its interface is something like 'top'. So for your example, I think that you can just create config file to provide your filter-code. So here is my filter-code in my config file. $ cat /tmp/conf filter-code: port ...


3

For normal ethernet, your snaplen (-s option) should be 1500 if you want the entire packet. That'll give you the entire packet, and allow full protocol decodes when loaded up into WireShark itself. Depending on what you're sniffing, you'll probably want to increase your filesize as well. To get at least the headers of most packets, a snaplen of 200 is ...


3

Assuming you already know how to use filters with tshark, just supply the following display filter: ssl.handshake.type == 1 If you want all ssl traffic, simply put ssl as the filter. You cannot use these directly in the capture filters as the capture filtering mechanism doesn't know if the payload is ssl or not. Alternatively, if you know what port the ...


3

Both tshark and tcpdump use the pcap library, so the capture filters use pcap-filter syntax. The filter you want is, as @tristan says, "not port 22". You can enter this as a quoted string argument to the -f option, or as an unquoted argument to the command. The following commands are equivalent: # tshark -f "not port 22" # tshark -- not port 22 The reason ...


2

I don't have access to a tshark installation currently, but assuming that it's the same as the tcpdump: sudo tcpdump not port 22 so, potentially: tshark not port 22


2

There is a small tool called pcaputil - it is part of the pjsip project. It should be able to decode pcap files with RTP (G.711, G.722, speex and other codecs are supported) into wav files. Compile pjsip and find pcaputil inside pjsip-apps/bin/samples/[architecture]/.


1

Work in progress: tshark -r $BIGFILE -T fields -e rpc.xid -R "nfs.fh.hash == 0x5c191ad8" | \ tshark -r $BIGFILE -R "$(\ python -c 'import sys; xids = sys.stdin.readlines(); print("||".join(["rpc.xid=={0}".format(xid.strip()) for xid in xids]))'\ )"


1

With tshark -r nfs.pcap -R 'nfs.fh.hash == 0x5c191ad8' you can get all requests or reply with fh. For more complicated cases I guess you need to write some code. There is a great tool for that http://git.linux-nfs.org/?p=mora/nfstest.git;a=summary


1

There is a command line component to wireshark called tshark which would do what you need. There's better instruction available here. Unfortunately, endpoints seem to be only available in the GUI. Another alternative might be to use X Forwarding to run Wireshark at the far side and forward the GUI to your local desktop. Without knowing what OS you're using ...


1

On CentOS they're all compiled into /usr/lib/libwireshark.so All of the filters are called dissectors within the source code and are located in epan/dissectors. The MySQL dissector is epan/dissectors/packet-mysql.c


1

You can also try "iptraf" it's lightweight and simple. It can filter by port and gives you high level info, no payload data, etc.


1

Just use your low-end box with tcpdump, tshark or wireshark (the console version) and save the output to a file. Then download that file to your powerful desktop and load it up to wireshark GUI version.


1

It is saving to the pcap format, read it with tshark, wireshark, tcpdump, etc. To read a file with tshark do a tshark -r filename.


1

See tool for splitting pcap files by TCP connection?, then feel a bit sad that I can't find anything for Linux that will keep a PCAP in proper form and filter by flow. If you can do it without focusing on the flows, then tshark will respect all the normal tcpdump (pdf link) filters. Read in the dump and set the -w output flag and filters and you'll get your ...


1

You can do it with tshark follow the below steps: Filter all HTTP packets with specific pattern in request uri Follow TCP stream based on src IP, src port, dst IP, dst port $ tshark -r x.pcap -R 'http.request.uri matches "^/resource/to/be/tested"' \ -T fields -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport | \ while read line; do tshark -r x.pcap ...


1

Presumably by "multicast groups it is recording" you mean that you've specified a capture filter asking for particular multicast destination addresses in a "host" keyword; that's the only way Wireshark could limit its packet capture to particular multicast groups. Wireshark has no mechanism by which it sends out IGMP subscriptions based on the capture ...


1

You can use "ip maddr add" to subscribe to additional groups. That should cause the kernel to respond to IGMP queries and receive traffic for them.


1

I was about to suggest wireshark (for it's many 'conversation' features), but it is not a command-line tool. You could try tshark though, which is a command-line analyzer tool that is closes to wireshark. The output should have (somewhat) what you're looking for (example below): tshark -R "ip.addr == 10.2.3.67" -z conv,ip -p -f "tcp port 22" Result: ...


1

Your best bet for monitoring the traffic is probably going to be sflow - have a look at your network equipment manufacturers' docs for configuring it on the switches. For aggregators, have a look at something like Argus or if you simple want to capture sflow data for process, see Inmon's sflow toolkit. There are other protocols in use in the wild, with MGCP ...


1

I would suggest using a dumbed down tcpdump command line that stores everything in a pcap file for post process. Depending on what exactly you are looking at diagnosing tcpflow works great for putting communications back together in a coherent way for analysis. Some other good information including some usages for httpry can be found at: ...



Only top voted, non community-wiki answers of a minimum length are eligible