i friends,

what tool can i used to capture packets of p2p clients such as bearshare,limewire,Ares.

i tried tcpdump but i really did not understand it. what exactly am i supporse to watch out for. Any help would be appreciated.

Thanks in Advance.

tcpdump is still the right tool to capture traffic whether you understand it or not you can also capture the data in wireshark, which is realistically probably what you actually want to hear.

in terms of what you're looking out for... well you're the one trying to capture traffic, you tell us what you want to look out for... why are you doing it?

Thanks for the reply, i am really new to tcpdump. i want to capture packet of a particular p2p client. what do i watch out for. THANKS

well in wireshark just filter with an expression like "ip.addr == a.b.c.d" to filter after capture. or use an input filter on wireshark or tcpdump of somethign like "host a.b.c.d". still short on details of what you want to get out of this though. i doubt you'll be able to make much sense of the raw ip data...

Thanks for for reply acid_kewpie. let me give you a full load-down of exactly what i want to acheive. You see, recently my network has really been granded by users who are constantly using p2p clients such as Bearshare, Imesh, Ares, etc.

How ever i have been doing a lot of research on this 2p2 clients and i found this site http://www.lowth.com/rope/BlockingGnutella that describes how i could patch my kernel and iptables with a module called rope and then successfully block 2p2 clients. pls take a look at this, http://www.lowth.com/rope/BlockingBittorrent. from this you will note that the packet of bittorrent was identified.

Secondly,same go for p2p clients that use Gnutella protocol. they are identified by this strings GNUTELLA CONNECT/digit(s).digit(s)\r\n

The main problem now is i want to write a rope script to block Ares and i need to capture its packets just the same way bittorrent packets was captured and used to block it.

Thanks

ok, well you don't block the program, you block the protocol, i.e. gnutella, bittorrent etc..., so the provided example in that link stands.