If you want to program with tcpdump check out its libary, pcap.
http://www.tcpdump.org/pcap.html
Lately I have been playing with a Go interface to it, https://github.com/miekg/pcap
Great tool, and lots of fun.
A tcpdump tutorial and primer
11–20 of 33 posts
Re: A tcpdump tutorial and primer
#12Who else remembers when tcpdump kept on refusing to put a "see raw packet" option because you might use it to steal passwords? Those were the days. Now all I can complain about is that you need root permissions on OpenBSD merely to read a capture file.
you need root permissions on OpenBSD merely to read a capture file.
How does that even work? It seems like if you can read the file there is nothing stoping you from trying to parse its contents.
Re: A tcpdump tutorial and primer
#13Just what I needed. Been writing an SSDP stack with the aid of wireshark and it's been painful. I'm on OSX so it's been a case of frigging around with XQuartz as much as anything else. tcpdump is just pleasure and power compared to wireshark.
Re: A tcpdump tutorial and primer
#14Earlier quoted context omitted.
Command-line alternative to wireshark is tshark. tshark is much more capable, since you can use all the well-made Wireshark protocol dissectors.
tshark also has a fabulous ring buffer feature that lets you run captures continuously while chunking the files up into manageable sizes. e.g. -b filesize:100000 -b files:200 -w somefile This will make a ring buffer of 200 * 100MB files. After typing this, I realized this may have limited use cases, but I use it almost every day.
It's a great ad-hoc solution for monitoring types of traffic. I've used it too. :-)
Re: A tcpdump tutorial and primer
#15Who else remembers when tcpdump kept on refusing to put a "see raw packet" option because you might use it to steal passwords? Those were the days. Now all I can complain about is that you need root permissions on OpenBSD merely to read a capture file.
you need root permissions on OpenBSD merely to read a capture file. How does that even work? It seems like if you can read the file there is nothing stoping you from trying to parse its contents.
It's in the binary. You can bring your own /usr/sbin/tcpdump if you wish. If this seems like an incredibly low bar to you, I agree.
Re: A tcpdump tutorial and primer
#16If you want to program with tcpdump check out its libary, pcap. http://www.tcpdump.org/pcap.html Lately I have been playing with a Go interface to it, https://github.com/miekg/pcap Great tool, and lots of fun.
[deleted]
Re: A tcpdump tutorial and primer
#17If you want to program with tcpdump check out its libary, pcap. http://www.tcpdump.org/pcap.html Lately I have been playing with a Go interface to it, https://github.com/miekg/pcap Great tool, and lots of fun.
[deleted]
Re: A tcpdump tutorial and primer
#18If you want to program with tcpdump check out its libary, pcap. http://www.tcpdump.org/pcap.html Lately I have been playing with a Go interface to it, https://github.com/miekg/pcap Great tool, and lots of fun.
Also for node programmers there is https://github.com/mranney/node_pcap I remember doing some pcap C programming some years ago but node with its streaming nature and powerful js derived abstractions is just so much more satisfying to me, simply less boilerplate and tons of fun - don't fall too far down the well.. then again it's Saturday tomorrow! ;)
Re: A tcpdump tutorial and primer
#19I guess it depends what you are trying to do. As someone who uses packet captures almost every day to solve other people's problems, all I want to see is an unfiltered binary capture file on the right interface, which I'll then go thru with tshark or Wireshark.
I think learning to build effective display filters in those tools is more useful than learning to use a capture tool in complex ways.
This can apply to troubleshooting your own problems too, as you can then inspect things in your own time and gather evidence to present later, and even use a capture file to replay traffic.
Re: A tcpdump tutorial and primer
#20I. Love. Tcpdump. Once in a blue moon I'll boot up Wireshark, but it's pretty rare that there's a protocol question I need to answer that I can't answer faster with tcpdump -A.
tcpdump is one of my pet responses when people ask me why I still use terminal-based tooling.