Tcpdump - Revision history

Jimbo at 02:45, 7 January 2009

2009-01-07T02:45:35Z

Dave: /* Common arguments */

2005-10-07T14:28:59Z

Common arguments

Dave: /* ok, but is it useful? */

2005-04-06T04:05:03Z

ok, but is it useful?

Jimbo: sorry Dave, should have been more specific - text-mode hex editor for *nix =)

2005-04-06T01:42:31Z

sorry Dave, should have been more specific - text-mode hex editor for *nix =)

Dave: /* ok, but is it useful? */

2005-04-05T22:45:26Z

ok, but is it useful?

Jimbo: english, mf, do you speak it?

2005-03-24T21:28:42Z

english, mf, do you speak it?

129.171.150.67: /* Common arguments */

2005-03-24T18:41:14Z

Common arguments

Dave: /* common options */

2005-03-15T19:13:12Z

common options

Dave: /* common options */

2004-12-05T18:30:48Z

common options

Dave: /* common options */

2004-12-05T18:29:30Z

common options

@@ Line 14: / Line 14: @@
   -p "do not put interface in promiscuous mode". By default, tcpdump will make your
      interface promiscuous.
 Note that if the src (source) or dst (destination) flags are not used to qualify the ip/port/net numbers specified, tcpdump assumes ''either'' source or destination:
   src port ''number'' "from this port"
@@ Line 19: / Line 22: @@
       port ''number'' "to or from this port"
-  src ip ''address'' "from this IP"
+  src host ''address'' "from this IP"
-  dst ip ''address'' "to this IP"
+  dst host ''address'' "to this IP"
-      ip ''address'' "to or from this IP"
+      host ''address'' "to or from this IP"
   src net ''number'' "from this network"
@@ Line 32: / Line 35: @@
 Just tonight, I discovered that while I had login information for an FTP site I hadn't touched in years saved in my Windows FTP client, I didn't remember what that password WAS, and I needed it to give to somebody else.  I looked in the data store for the FTP client, but unfortunately the passwords were stored as hashes.  Rather than try to figure out the encryption algorithm used and then find a brute force cracker somewhere, I just shelled into my [[firewall]] and set up a '''tcpdump''' session to capture the packets:
-  ph34r# '''tcpdump -pw /home/jimbo/ftpsniff.tcpdump.bin -i xl0 dst port 21'''
+  ph34r# '''tcpdump -pA -s0 -w /home/jimbo/ftpsniff.tcpdump.bin -i xl0 dst port 21'''
   tcpdump: listening on xl0
 Now my firewall is monitoring all traffic through its inside interface, and dumping any packets headed out to an FTP server to the file '''/home/jimbo/ftpsniff.tcpdump.bin'''.  So I fire up my Windows FTP client, connect to the FTP site and let it authenticate, and then immediately hit CTRL-C in ph34r to interrupt the tcpdump session:
-  ph34r# '''tcpdump -pw /home/jimbo/ftpsniff.tcpdump.bin -i xl0 dst port 21'''
+  ph34r# '''tcpdump -pA -s0 -w /home/jimbo/ftpsniff.tcpdump.bin -i xl0 dst port 21'''
   tcpdump: listening on xl0
   ^C

@@ Line 26: / Line 26: @@
   dst net ''number'' "to this network"
       net ''number'' "to or from this network"
-[[tcpdump]] understands boolean operators (and not or, etc) and can take hostnames, IPs, networks and protocols as arguments. The output is terse and hard to understand if you don't know what you're looking at or for; for this reason many folks prefer friendlier front-ends to tcp, such as ethereal.
+[[tcpdump]] understands boolean operators (and not or, etc) and can take hostnames, IPs, networks and protocols as arguments. The output is terse and hard to understand if you don't know what you're looking at or for; for this reason many folks prefer friendlier front-ends to tcp, such as [[ethereal]].
 ==ok, but is it useful?==

@@ Line 43: / Line 43: @@
 packets dropped by kernel
-And hex editing the raw tcp dump (I cheated and used UltraEdit on my windows box; I don't have a good text-mode hex editor for *nix yet.  Anyone got any recommendations?) and searching for PASS led me to this snippet:
+And hex editing the raw tcp dump (I cheated and used UltraEdit on my windows box; I don't have a good text-mode hex editor for *nix yet.  Anyone got any recommendations? see the discussion page...) and searching for PASS led me to this snippet:
   PASS V9xo3Pr1

@@ Line 43: / Line 43: @@
 packets dropped by kernel
-And hex editing the raw tcp dump (I cheated and used UltraEdit on my windows box; I don't have a good hex editor for *nix yet.  Anyone got any recommendations? (dave sez: http://home.online.no/~espensa/khexedit/) ) and searching for PASS led me to this snippet:
+And hex editing the raw tcp dump (I cheated and used UltraEdit on my windows box; I don't have a good text-mode hex editor for *nix yet.  Anyone got any recommendations?) and searching for PASS led me to this snippet:
   PASS V9xo3Pr1

@@ Line 43: / Line 43: @@
 packets dropped by kernel
-And hex editing the raw tcp dump (I cheated and used UltraEdit on my windows box; I don't have a good hex editor for *nix yet.  Anyone got any recommendations?) and searching for PASS led me to this snippet:
+And hex editing the raw tcp dump (I cheated and used UltraEdit on my windows box; I don't have a good hex editor for *nix yet.  Anyone got any recommendations? (dave sez: http://home.online.no/~espensa/khexedit/) ) and searching for PASS led me to this snippet:
   PASS V9xo3Pr1

@@ Line 3: / Line 3: @@
 ==Common arguments==
-  -c ''number'' "sniff this many packets". By default, tcpdump will sniff until you tell it not to.
+  -c ''number'' "sniff this many packets". By default, tcpdump will sniff until
-    Using this flag will cause it to stop at a certain number of packets instead of waiting for an
+    you tell it not to. Using this flag will cause it to stop at a certain number
-    interruption (like cntrl-C...or running out of diskspace, if you're writing to a file).
+    of packets instead of waiting for an interruption (like cntrl-C...or running
-  -i ''interface''"listen on this interface". If you want traffic from just one network interface, you want to use this option.
+    out of diskspace, if you're writing to a file).
   -a "convert IPs to names if you can"
   -w ''filename'' "write this to a file". you must give a filename to write to.
   -q "don't be so verbose" -- strips more protocol information
-  -p "do not put interface in promiscuous mode". By default, tcpdump will make your interface promiscuous.
+  -p "do not put interface in promiscuous mode". By default, tcpdump will make your
 Note that if not src (source) or dst (destination) port/ip/net is specified, tcpdump assumes ''either'' source or destination:
   src port ''number'' "from this port"