Tuesday, 11 September 2018

tcpdump -nnXSs

Taken: https://www.askbjoernhansen.com/2007/07/12/how_to_dump_packets_with_tcpdump.html

I always forget the parameters for this and have to look them up in the man page, so enough of that:

 tcpdump -nnXSs 0 port 80


  • "-nn" makes it not lookup hostnames in DNS and service names (in /etc/services) for respectively faster and cleaner output. 
  • "-X" makes it print each packet in hex and ascii; that's really the useful bit for tracking headers and such 
  • "-S" print absolute rather than relative TCP sequence numbers - If I remember right this is so you can compare tcpdump outputs from multiple users doing this at once 
  • "-s 0" by default tcpdump will only capture the beginning of each packet, using 0 here will make it capture the full packets. We are debugging, right? 

No comments:

Post a Comment

Note: only a member of this blog may post a comment.

Interview questions: 2020-12

Terraform provider vs provisioner Load balancing Network Load Balancer vs Application Load Balancer  Networking Layer 1 vs Layer 4 haproxy u...