A tcpdump tutorial and primer
danielmiessler.com
A tcpdump tutorial and primer
1–10 of 33 posts
Re: A tcpdump tutorial and primer
#2Previous discussion: https://news.ycombinator.com/item?id=4744427
Re: A tcpdump tutorial and primer
#3I. Love. Tcpdump. Once in a blue moon I'll boot up Wireshark, but it's pretty rare that there's a protocol question I need to answer that I can't answer faster with tcpdump -A.
Re: A tcpdump tutorial and primer
#4tcpdump for the win!
Re: A tcpdump tutorial and primer
#5To send tcpdump output to your local Wireshark:
ssh -c arcfour root@myserver tcpdump -nn -U -s0 -w - 'not port 22' | wireshark -k -i -
Re: A tcpdump tutorial and primer
#6I use this tutorial all the time when I'm trying to debug MTA issues.
Re: A tcpdump tutorial and primer
#7Awesome! I always wanted a command-line alternative to wireshark. I learned about tcpdump about a year ago, but the amount of options is a little off putting. I'm glad this guide came along.
Re: A tcpdump tutorial and primer
#8Awesome! I always wanted a command-line alternative to wireshark. I learned about tcpdump about a year ago, but the amount of options is a little off putting. I'm glad this guide came along.
Command-line alternative to wireshark is tshark. tshark is much more capable, since you can use all the well-made Wireshark protocol dissectors.
Re: A tcpdump tutorial and primer
#9Who else remembers when tcpdump kept on refusing to put a "see raw packet" option because you might use it to steal passwords?
Those were the days. Now all I can complain about is that you need root permissions on OpenBSD merely to read a capture file.
Re: A tcpdump tutorial and primer
#10Awesome! I always wanted a command-line alternative to wireshark. I learned about tcpdump about a year ago, but the amount of options is a little off putting. I'm glad this guide came along.
Command-line alternative to wireshark is tshark. tshark is much more capable, since you can use all the well-made Wireshark protocol dissectors.
tshark also has a fabulous ring buffer feature that lets you run captures continuously while chunking the files up into manageable sizes.
e.g. -b filesize:100000 -b files:200 -w somefile
This will make a ring buffer of 200 * 100MB files.
After typing this, I realized this may have limited use cases, but I use it almost every day.