This is a great tool for getting free wi-fi if you know what you're doing and can change your MAC address.
A tcpdump tutorial and primer
21–30 of 33 posts
Re: A tcpdump tutorial and primer
#22Earlier quoted context omitted.
Command-line alternative to wireshark is tshark. tshark is much more capable, since you can use all the well-made Wireshark protocol dissectors.
tshark also has a fabulous ring buffer feature that lets you run captures continuously while chunking the files up into manageable sizes. e.g. -b filesize:100000 -b files:200 -w somefile This will make a ring buffer of 200 * 100MB files. After typing this, I realized this may have limited use cases, but I use it almost every day.
If you are on a system that doesn't have tshark, tcpdump provides the same functionality via the -C -W flags.
e.g. -C 100 -W 200 -w somefile will get you the same circular ring of 200 100MB files.
Also, don't forget to add the -s 0 flag if you want to get the entire payload.
Re: A tcpdump tutorial and primer
#23If you want to program with tcpdump check out its libary, pcap. http://www.tcpdump.org/pcap.html Lately I have been playing with a Go interface to it, https://github.com/miekg/pcap Great tool, and lots of fun.
Also for node programmers there is https://github.com/mranney/node_pcap I remember doing some pcap C programming some years ago but node with its streaming nature and powerful js derived abstractions is just so much more satisfying to me, simply less boilerplate and tons of fun - don't fall too far down the well.. then again it's Saturday tomorrow! ;)
For those who want a functional(ish?) and strongly typed interface to tcpdump, hackage has the answer:
http://hackage.haskell.org/package/pcap-0.2/docs/Network-Pca...
Re: A tcpdump tutorial and primer
#24I. Love. Tcpdump. Once in a blue moon I'll boot up Wireshark, but it's pretty rare that there's a protocol question I need to answer that I can't answer faster with tcpdump -A.
Hmm, how about display TCP payload only, capture SSL without ssldump, filter packets by process id?
Re: A tcpdump tutorial and primer
#25I. Love. Tcpdump. Once in a blue moon I'll boot up Wireshark, but it's pretty rare that there's a protocol question I need to answer that I can't answer faster with tcpdump -A.
If you're on a server that doesn't have an X environment set up for wireshark, you can use tcpdump to spit to a file:
-w Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''. See pcap-savefile(5) for a description of the file format.
You can then open this file in wireshark on your desktop for easier analysis if you wish.
Re: A tcpdump tutorial and primer
#26I. Love. Tcpdump. Once in a blue moon I'll boot up Wireshark, but it's pretty rare that there's a protocol question I need to answer that I can't answer faster with tcpdump -A.
Hmm, how about display TCP payload only, capture SSL without ssldump, filter packets by process id?
It feels like ssldump has been abandoned and is horribly out-of-date. Is anybody maintaining it these days?
Re: A tcpdump tutorial and primer
#27Earlier quoted context omitted.
Hmm, how about display TCP payload only, capture SSL without ssldump, filter packets by process id?
It feels like ssldump has been abandoned and is horribly out-of-date. Is anybody maintaining it these days?
I use ssldump all the time; I don't think it's actively maintained, but it's not like it's broken. (The author of ssldump is one of the chairs of the TLS WG).
Re: A tcpdump tutorial and primer
#28To send tcpdump output to your local Wireshark: ssh -c arcfour root@myserver tcpdump -nn -U -s0 -w - 'not port 22' | wireshark -k -i -
I'd think you'd do well to stay away from RC4 for ssh as well as SSL/TLS?
Re: A tcpdump tutorial and primer
#29I. Love. Tcpdump. Once in a blue moon I'll boot up Wireshark, but it's pretty rare that there's a protocol question I need to answer that I can't answer faster with tcpdump -A.
If you're on a server that doesn't have an X environment set up for wireshark, you can use tcpdump to spit to a file: -w Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''. See pcap-savefile(5) for a description of the file format. -- You can then open this file in wireshark on your desktop for easier analysis…
Yeah, I do this all the time also with -s0 (saves all data traffic as well). You need some kind of filter because of all the traffic, but you can see everything afterwards. Easy to use wireshark to show TCP streams reconstructed: http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowT... .
Re: A tcpdump tutorial and primer
#30Correct me if I'm wrong, but hasn't tcpdump had several buffer overflows in the past?
Personally I prefer multilog + pflogd + some other tool to examine the pcap file.
My old favorite is nc-data -d. The entire program fits on one page.
od or xxd -c1 |cut -d: -f2 will work too.
ngrep is fussy about interface types but I use that too.
Filters for nc-data output can be written in lex, sed, awk, lua, whatever.
I've even experimented with snobol4 and spitbol on packets since the output format of nc-data is so simple.