LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-08-2006, 07:30 AM   #1
Nathanael
Member
 
Registered: May 2004
Location: Karlsruhe, Germany
Distribution: debian, gentoo, os x (darwin), ubuntu
Posts: 940

Rep: Reputation: 32
dump packet data to file, but no packet header


hello there,

i am trying to dump packet data to a file in the style of netcat (eg. when natcat is listening on port 80 and you connect with a browser, that output) but it gets slightly more tricky:

i need to grab sql statements out of packet data destined for another host.
the point of this is to afterwards be able to analyze data.
1. i tried using netcat (nc) but i cannot get packet data which is not destined for my host. setting up iptables and ebtables with '-j REDIRECT' did not help either.
2. using tcpdump to grab a few packets, then reading with flowreplay and sending them to 127.0.0.1 where nc was listening worked, though it looks like the packet data got reassebled incorrectly (on the netcat side of things)

if anybody can point me into a direction that would be grand

it is all legal, as 1. we are running in a test network for this, 2. one of our clients asked for it to monitor their server.
 
Old 02-08-2006, 08:56 AM   #2
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
I believe there are many legitimate uses for this, don't worry. In any case, are you just looking for packet payloads without any header? Ethereal can use tcpdump to dissect many protocols, and you hould be able to dump the protocol-level data to a file for further analysis.
 
Old 02-08-2006, 09:22 AM   #3
Nathanael
Member
 
Registered: May 2004
Location: Karlsruhe, Germany
Distribution: debian, gentoo, os x (darwin), ubuntu
Posts: 940

Original Poster
Rep: Reputation: 32
let us assume a oracle server, clients sent the sql statments clear text, thou sometimes they are too long to fit inside a single packet...
i just want reassembled sql statements....
i need to monitor for a few weeks before analyzing the statements, so having to post-pocess would not be ideal. better would be the ability to log directly to a file with what i need...
 
Old 02-08-2006, 10:27 AM   #4
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
I guess the hard part is figuring out how to reassemble the packets from the tcpdump. You'd have to look at the client and the sequence numbers to figure it out.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how do i read the data in the packet that i have captured after packet capture? gajaykrishnan Programming 23 04-19-2006 05:09 AM
access IP header in packet linux_lover2005 Programming 3 04-11-2005 01:02 AM
packet dump linux_lover2005 Linux - Newbie 0 01-01-2005 06:55 AM
How to get the IP header of packet going through an interface thanh Programming 1 06-12-2004 12:26 PM
Edit packet header? mudvayne Linux - Networking 4 03-28-2003 01:43 PM


All times are GMT -5. The time now is 08:19 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration