getting more from tcpdump

lumix · 10-31-2007, 09:49 AM

Can tcpdump (strangely named since it's not exclusive to tcp) inspect and output layer 7 header information?

Can it do the same for the packet's actual payload, or contents?

Can ethereal expressions somehow be translated or traced back to an underlying tcpdump expression?

Would you suggest a different cli sniffer?

thanks.

acid_kewpie · 10-31-2007, 09:57 AM

well i'd suggest tshark, which is just as powerful as wireshark (which is what ethereal used to be) tcpdump isn't intended to dissect traffic that much. it can do *some* but not a huge amount, unlike wireshark.

lumix · 10-31-2007, 11:07 AM

Thanks. Do you happen to know if wireshark (what seems to install on Ubuntu even if I apt-get ethereal) has a cli?

acid_kewpie · 10-31-2007, 03:03 PM

er, did you read my reply at all? yes there is, it's called tshark.