I tried this:
tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'
I need only the ascii part of it. How do I remove the rest?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
As Josh suggests, tcpflow can print just the TCP packet data to a file or STDOUT. You can pipe tcpdump to tcpflow like this:
tcpdump -i lo -l -w - port 23 | tcpflow -C -r -
To only view one side of the conversation, you can use filters for tcpdump, e.g.
dst port 23.
I'm not sure about the exact syntax for
tcpdump... in fact, I have marked this question as a favorite because I would like to know! But as an alternative solution, you could try using
tcpflow instead. It works essentially the same way, but it prints ASCII output much better; it excluded the headers and prints packets sequentially as a flow, so it's easier to read and follow at times than
I feel the most elegant solution is just to ditch tcpdump. No pipes of any kind:
tcpflow -c port 6667
And that's it.
A quick and dirty way to do this is to filter the output through strings:
tcpdump -nli eth0 '(port 6667) and (length > 74)' -s 0 -w - | strings
Sometimes you don't have other tools and for a quick peek into the payload this is enough. It's no good if you need the exact payload for injection or an exact analysis, of course.
If you need only the ASCII part you can use:
tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'|sed 's/\.//g' or with ngrep:
ngrep -d eth0 -lq . '(port 6667) and (length > 74)' |sed -rn '/^ /s/\.//gp'
I had the same problem last week - I used the wireshark gui instead and did a "copy readable ascii" for the interesting packets.
I was (successfully) trying to pin down a problem with a http request to a web-service and its XML-answer.