tcpdump
One of the early diagnostic tools for TCP/IP that was written by Van Jacobson, Craig Leres, and Steven McCanne. Tcpdump can be used to capture and decode packets in real time, or to capture packets to files (in "libpcap" format, see below), and analyze (decode) them later.
There are now more elaborate and, in some ways, user-friendly packet capturing programs, such as Wireshark (formerly called Ethereal), but tcpdump
is widely available, widely used, so it is very useful to know how to use it.
Tcpdump/libpcap is still actively being maintained, although not by its original authors.
libpcap
Libpcap is a library that is used by tcpdump
, and also names a file format for packet traces. This file format - usually used in files with the extension .pcap
- is widely supported by packet capture and analysis tools.
Some useful options to tcpdump
include:
-s snaplen
capture snaplen bytes of each frame. By default, tcpdump
captures only the first 68 bytes, which is sufficient to capture IP/UDP/TCP/ICMP headers, but usually not payload or higher-level protocols. If you are interested in more than just headers, use -s 0
to capture packets without truncation.-r filename
read from an previously created capture file (see =-w=)-w filename
dump to a file instead of analyzing on-the-fly-i interface
capture on an interface other than the default (first "up" non-loopback interface). Under Linux, -i any
can be used to capture on all interfaces, albeit with some restrictions.-c count
stop the capture after count packets-n
don't resolve addresses, port numbers, etc. to symbolic names - this avoids additional DNS traffic when analyzing a live capture.-v
verbose output-vv
more verbose output-vvv
even more verbose outputAlso, a pflang expression can be appended to the command so as to filter the captured packets. An expression is made up of one or more of "type", "direction" and "protocol".
host
, net
or port
. host
is presumed unless otherwise speciifiedsrc
, dst
, src or dst
or src and dst
ether
, ip
, tcp
, udp
, arp
... If none is specifiied then all protocols for which the value is valid are considered.dst host <address>
src host <address>
udp dst port <number>
host <host> and not port ftp and not port ftp-data
Capture a single ( -c 1=) =udp
packet to file test.pcap
:
: root@diotima[tmp]; tcpdump -c 1 -w test.pcap udp tcpdump: listening on bge0, link-type EN10MB (Ethernet), capture size 96 bytes 1 packets captured 3 packets received by filter 0 packets dropped by kernel |
This produces a binary file containing the captured packet as well as a small file header and a timestamp:
: root@diotima[tmp]; ls -l test.pcap -rw-r--r-- 1 root root 114 2006-04-09 18:57 test.pcap : root@diotima[tmp]; file test.pcap test.pcap: tcpdump capture file (big-endian) - version 2.4 (Ethernet, capture length 96) |
Analyze the contents of the previously created capture file:
: root@diotima[tmp]; tcpdump -r test.pcap reading from file test.pcap, link-type EN10MB (Ethernet) 18:57:28.732789 2001:630:241:204:211:43ff:fee1:9fe0.32832 > ff3e::beac.10000: UDP, length: 12 |
Display the same capture file in verbose mode:
: root@diotima[tmp]; tcpdump -v -r test.pcap reading from file test.pcap, link-type EN10MB (Ethernet) 18:57:28.732789 2001:630:241:204:211:43ff:fee1:9fe0.32832 > ff3e::beac.10000: [udp sum ok] UDP, length: 12 (len 20, hlim 118) |
tcpdump
use cases.-- Main.SimonLeinen - 2006-03-04 - 2016-03-17