LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-07-2006, 12:07 PM   #1
hedpe
Member
 
Registered: Jan 2005
Location: Pittsburgh
Distribution: Ubuntu
Posts: 378

Rep: Reputation: 30
not capture payload with tcpdump?


Hey guys,

I only want to record packet headers to a file via "tcpdump -w traffic.log" and I do not want it to save the payload or else the log could get huge.

Thanks!
George
 
Old 02-07-2006, 01:27 PM   #2
stress_junkie
Senior Member
 
Registered: Dec 2005
Location: Massachusetts, USA
Distribution: Ubuntu 10.04 and CentOS 5.5
Posts: 3,873

Rep: Reputation: 331Reputation: 331Reputation: 331Reputation: 331
How about

tcpdump -e > traffic.log
 
Old 02-07-2006, 01:31 PM   #3
hedpe
Member
 
Registered: Jan 2005
Location: Pittsburgh
Distribution: Ubuntu
Posts: 378

Original Poster
Rep: Reputation: 30
yeah, i guess that works, but i should have been more specific

i need to keep a file format so that i can open it in ethereal and do filtering and look through packet headers easier

maybe i am mistaken, because tcpdump -w traffic.log doesn't seem to be capturing the payloads... instead when I open it in ethereal i see "packet size limited during capture"

I am not sure this is the way I want to go though because it could possibly truncate a header, and i need all headers and full headers

thanks!
George

Last edited by hedpe; 02-07-2006 at 01:36 PM.
 
Old 02-07-2006, 01:37 PM   #4
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
maybe:
Code:
tcpdump -l -v -n -e > traffic.log
 
Old 02-07-2006, 01:56 PM   #5
hedpe
Member
 
Registered: Jan 2005
Location: Pittsburgh
Distribution: Ubuntu
Posts: 378

Original Poster
Rep: Reputation: 30
says that the log file is not in a format it can understand
 
Old 02-07-2006, 02:13 PM   #6
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
ok. nevermind. it was a shot in the dark.

anyone know how to get tcpdump to output a log that is completely understandable by ethereal??

Last edited by win32sux; 02-07-2006 at 02:15 PM.
 
Old 02-07-2006, 02:23 PM   #7
hedpe
Member
 
Registered: Jan 2005
Location: Pittsburgh
Distribution: Ubuntu
Posts: 378

Original Poster
Rep: Reputation: 30
by using -w file.log, ethereal can understand it, however I can't figure out how to remove the payload and keep all headers
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to read UDP packet payload ? sceadu Programming 2 02-07-2006 09:00 PM
retransmiting tcpdump capture file? JWT2 Linux - Networking 9 10-09-2005 08:27 AM
iptables and payload filtering mosio Red Hat 1 07-09-2005 05:09 PM
How to use skbuff to scan every byte of the payload of an UDP packet? sceadu Programming 0 11-03-2004 09:34 PM
how to include my payload with packet that kernel sends to other pc cranium2004 Linux From Scratch 0 02-23-2004 02:11 AM


All times are GMT -5. The time now is 11:55 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration