I tried this:
tcpdump -s 1500 -A -l -i eth0 '(port 6667) and (length > 74)'
I need only the ascii part of it. How do I remove the rest?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
I'm not sure about the exact syntax for
tcpdump... in fact, I have marked this question as a favorite because I would like to know! But as an alternative solution, you could try using
tcpflow instead. It works essentially the same way, but it prints ASCII output much better; it excluded the headers and prints packets sequentially as a flow, so it's easier to read and follow at times than
A quick and dirty way to do this is to filter the output through strings:
tcpdump -nli eth0 '(port 6667) and (length > 74)' -s 0 -w - | strings
Sometimes you don't have other tools and for a quick peek into the payload this is enough. It's no good if you need the exact payload for injection or an exact analysis, of course.