3

Is there a way to stop tcpdump from (mis)interpreting protocols in captured packets?

It assumes that traffic coming from port 4500/udp is always IPSec traffic, 53/udp is DNS query, etc and tries to decode it. That's a problem for me because I can't parse the output properly.

1 Answer 1

4

You can use the '-q' option to remove the content decoding. You can maybe add the '-A' to see in ASCII the content of the packets, or -dd to see in C format.

1
  • You might also try the -nn flag to prevent host and port name resolution. Jun 3, 2016 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .