24

I tried this:

tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'

I need only the ascii part of it. How do I remove the rest?

  • 1
    with tshark you can do it with: tshark -l -i eth0 -f 'port 6667 and greater 74' -T field -e data – Marcin Nov 28 '10 at 17:02
  • It says 28 packets captured but doesn't print anything to STDOUT. – coder Nov 29 '10 at 16:47
  • Do you mean ASCII7? – Mircea Vutcovici Apr 14 '11 at 16:05
14

As Josh suggests, tcpflow can print just the TCP packet data to a file or STDOUT. You can pipe tcpdump to tcpflow like this:

tcpdump -i lo -l -w - port 23 | tcpflow -C -r -

To only view one side of the conversation, you can use filters for tcpdump, e.g. dst port 23.

  • 4
    Why would you need to start tcpflow as root? – Ruslan Mar 13 '14 at 8:56
5

I'm not sure about the exact syntax for tcpdump... in fact, I have marked this question as a favorite because I would like to know! But as an alternative solution, you could try using tcpflow instead. It works essentially the same way, but it prints ASCII output much better; it excluded the headers and prints packets sequentially as a flow, so it's easier to read and follow at times than tcpdump.

5

I feel the most elegant solution is just to ditch tcpdump. No pipes of any kind:

tcpflow -c port 6667

And that's it.

  • You saved my life, I want to buy you a cookie – gdaras Dec 10 '18 at 13:25
4

A quick and dirty way to do this is to filter the output through strings:

tcpdump -nli eth0 '(port 6667) and (length > 74)' -s 0 -w - | strings

Sometimes you don't have other tools and for a quick peek into the payload this is enough. It's no good if you need the exact payload for injection or an exact analysis, of course.

1

If you need only the ASCII part you can use: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'|sed 's/\.//g' or with ngrep: ngrep -d eth0 -lq . '(port 6667) and (length > 74)' |sed -rn '/^ /s/\.//gp'

1

I had the same problem last week - I used the wireshark gui instead and did a "copy readable ascii" for the interesting packets.

I was (successfully) trying to pin down a problem with a http request to a web-service and its XML-answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.