tcpdump is a Linux program that can be used to capture network traffic to and from a Linux server and it’s clients.<\/p>\n
It is well-docmented and needs no further description. This post just describes a particular, restricted, way of using it to capture packets between a specific client computer and the server, and to send the output to a file which can subsequently be read by the same program.<\/p>\n
<\/p>\n
From specific client (a laptop = host 198.168.1.90)\r\n---------------------------------------------------\r\n\r\n-- capture the packets:\r\n-i = on interface bond0\r\nhost = from client 198.168.1.90\r\n-A = ASCII\r\n-s = capture size 0 (65535 bytes by default)\r\n\r\ntcpdump -i bond0 host 198.168.1.90 -A -s0 -w \/tmp\/rayfox.pcap\r\n\r\n-- read pcap file and output to text file\r\ntcpdump -A -r \/tmp\/rayfox.pcap > \/tmp\/rayfox.txt<\/pre>\n(File can also be read using Wireshark)<\/p>\n
To get the date from the pcap file<\/h2>\n
\r\n[root@server1 tmp] tcpdump -tttt -qns 0 -A -r server1_capture.pcap\r\n<\/pre>\nCapture on a Specific Interface<\/h2>\n
\r\n# Capture on a specific interface (NIC or bond)\r\ntcpdump -vXSs0 -i bond2 -w recv_mcast_java_1_1500.pcap\r\n<\/pre>\nRead the tcpdump file, pipe to less for more control<\/h2>\n
\r\n# read the captured file\r\ntcpdump -qns 0 -A -r recv_mcast_java_1_1500.pcap|less\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"tcpdump tcpdump is a Linux program that can be used to capture network traffic to and from a Linux server and it’s clients. It is well-docmented and needs no further description. This post just describes a particular, restricted, way of … Continue reading