32

I tried this:

tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'

I need only the ascii part of it. How do I remove the rest?

3
  • 1
    with tshark you can do it with: tshark -l -i eth0 -f 'port 6667 and greater 74' -T field -e data
    – Marcin
    Nov 28 '10 at 17:02
  • It says 28 packets captured but doesn't print anything to STDOUT.
    – coder
    Nov 29 '10 at 16:47
  • Do you mean ASCII7? Apr 14 '11 at 16:05
18

As Josh suggests, tcpflow can print just the TCP packet data to a file or STDOUT. You can pipe tcpdump to tcpflow like this:

tcpdump -i lo -l -w - port 23 | tcpflow -C -r -

To only view one side of the conversation, you can use filters for tcpdump, e.g. dst port 23.

1
  • 4
    Why would you need to start tcpflow as root?
    – Ruslan
    Mar 13 '14 at 8:56
10

I feel the most elegant solution is just to ditch tcpdump. No pipes of any kind:

tcpflow -c port 6667

And that's it.

2
  • 1
    You saved my life, I want to buy you a cookie
    – gdaras
    Dec 10 '18 at 13:25
  • And you can use -D to print the data in hex, in case your traffic isn't textual.
    – Ruslan
    Dec 4 '20 at 5:45
5

I'm not sure about the exact syntax for tcpdump... in fact, I have marked this question as a favorite because I would like to know! But as an alternative solution, you could try using tcpflow instead. It works essentially the same way, but it prints ASCII output much better; it excluded the headers and prints packets sequentially as a flow, so it's easier to read and follow at times than tcpdump.

4

A quick and dirty way to do this is to filter the output through strings:

tcpdump -nli eth0 '(port 6667) and (length > 74)' -s 0 -w - | strings

Sometimes you don't have other tools and for a quick peek into the payload this is enough. It's no good if you need the exact payload for injection or an exact analysis, of course.

1

If you need only the ASCII part you can use: tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'|sed 's/\.//g' or with ngrep: ngrep -d eth0 -lq . '(port 6667) and (length > 74)' |sed -rn '/^ /s/\.//gp'

1

I had the same problem last week - I used the wireshark gui instead and did a "copy readable ascii" for the interesting packets.

I was (successfully) trying to pin down a problem with a http request to a web-service and its XML-answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.