I am using the following tcpdump command on CentOS 7:

sudo tcpdump -A -l -i any -s 0 -n host <IP Address> and port 5060 or port 5061

And I am seeing (on each packet) the following sorts of output:

11:44:37.507716 IP <Host IP Address>.sip > <IP Address From Above>.sip-tls: SIP: SIP/2.0 403 Forbidden
E..;8H..@.L"A.,.k........'.pSIP/2.0 403 Forbidden
Via: SIP/2.0/UDP <IP Address From Above>:5061;branch=z9hG4bK-a6f419b5
From: <sip:111111@<Hostname>>;tag=f9a35797b435489o1
To: <sip:<Hostname>>;tag=2484f1a5f06b7307c34ab1dd8d74150a.45a2
Call-ID: fefdadf9-60423609@
CSeq: 199601 NOTIFY
Content-Length: 0

I am piping this output to another script, and I am not sure what to do with the lines like this:

E..;8H..@.L"A.,.k........'.pSIP/2.0 403 Forbidden

I see that sort of "random" output on every single packet, despite knowing that SIP/2.0 403 Forbidden should be the entirety of the line, and I am unable to find a flag in the man page that may suppress those lines. I have also tried adding -v to the command which will offer some extra formatting, but the "random" data still remains as the prefix to some of the lines in the packet.

What does that data represent, and is it possible to hide it when using tcpdump?


  • Might tell us what you are actually trying to get out of your capture. Why did you add the -A in the first place?
    – Zoredache
    Oct 21 '19 at 18:58

The -A option means 'print each packet', which is "random" output you are seeing. That data is the contents of the packet.

You might be best just capturing to a file using tcpdump and then loading those capture files into Wireshark as it has tools to work with SIP captures.

  • Or maybe try -X instead of -A which will give you a hexdump style output. Though both of them aren't very useful most of the time unless you know the protocol so well you can decode it in your head.
    – Zoredache
    Oct 21 '19 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.