31–40 of 41 posts
Earlier quoted context omitted.
You are doing it wrong if you are "reading through a long man page".
What is the „correct“ way? (real question, I am curious)
> https://en.m.wikipedia.org/wiki/Apropos_(Unix)
Also, of course see:
tshark is supposed to be a tcpdump alternative but it seems tcpdump is still dominant on the command line these days.
Earlier quoted context omitted.
Lots of tools can do this. I use mitmproxy personally. You can easily customize it by using it as a python library.
Looks like this requires me to redirect all traffic through a proxy server. This sounds very different from what I want to do. I don't want to change the data path in any way. I just want to listen in.
tshark is supposed to be a tcpdump alternative but it seems tcpdump is still dominant on the command line these days.
tshark always hogs my RAM and eventually crashes on > 4GB pcaps. I'd love to have a solution for this.
https://linux.die.net/man/1/tcpflow
If you are looking to do TCP level protocol analysis it is one of the simplest and easiest linux command line tools out there.
It's biggest strength is that it can take a payload split over multiple packets and spit it out as a file with the whole payload
Earlier quoted context omitted.
I have always had to use -nn to not translate ports. If what you say is true, it must be recent.
I've always used -nn (or -n -n), it's really annoying - usually I want to resolve IPs, but not ports.
I use tcpdump continuously to analyse multiple RTP feeds coming in to our edge network. Found all sorts of issues with it, including packet reordering in Cisco and mikrotik routers (shouldn't be a problem with rtp - but tell that to ateme decoders), actual packet loss on juniper srx, and of course minor outages on international and even local links on the order of 100-200ms of loss. Packet stream is dumped into some…
BTW I really recommend unbuffer from expect, if you are using tcpdump and pipes.
If anyone is interested I've made some notes here: https://null.53bits.co.uk/index.php?page=tcpdump-notes
For example, imagine spanning/mirroring a 10G backbone link, how many people are pinging 8.8.8.8 all the time. I can ping with a specific DSCP value set to isolate my pings from anyone elses, looking into the reported issue of 8.8.8.8 latency, then apply a filter to tcpdump on my mirrored port that matches ICMP traffic to a specific IP, with a specific DSCP value, inside specific L3 VPN (specific MPLS labels) etc.
sudo tcpdump -nlASX -s 65535 -vvv -i eth3 '(mpls 52634 and (ip and (ip[1] & 0xfc) >> 2 > 0x01) and host 11.22.33.44 and icmp)'
I love tcpdump's filtering capabilities.
NetEng here, I'm usually troubleshooting lower layer issues (Ethernet, MPLS, IP) than HTTP however, tcpdump is one of my go-to tools every time. If anyone is interested I've made some notes here: https://null.53bits.co.uk/index.php?page=tcpdump-notes For example, imagine spanning/mirroring a 10G backbone link, how many people are pinging 8.8.8.8 all the time. I can ping with a specific DSCP value set to isolate my pi…
Good stuff, thanks for sharing. I always forget you can do indexing into the packet itself as in tcp[((tcp[12:1] & 0xf0) >> 2):4]. Also sometimes I reach for ngrep if it is installed: https://github.com/jpr5/ngrep/blob/master/EXAMPLES.md
This is one of my favorite oneliners: sudo stdbuf -oL -eL /usr/sbin/tcpdump -A -s 10240 \ "tcp port 4080 and (((ip[2:2] - ((ip[0]&0xf) >2)) != 0)" | \ grep -a --line-buffered ".+(GET |HTTP\/|POST )|^[A-Za-z0-9-]+: " | \ perl -nle 'BEGIN{$|=1} { s/.*?(GET |HTTP\/[0-9.]* |POST )/\n$1/g; print }'