How to dump packet data on shell

doshirohan · 12-13-2008, 04:24 PM

Hello experts here,

I know how to capture packets in userspace using libipq.h and netfilter architecture. I got packet in buffer using ipq_read and converted it to ipq_packet_msg_t. I want to display data part of its payload. I want to skip the header part containing tcp and ip header and show only data contained in the packet. Can anybody help me to do this.

angel115 · 01-07-2009, 09:57 AM

Did you have a look to TCPdump?

Angel

doshirohan · 01-08-2009, 12:05 PM

Well that is quite nice tool to display all packets on the kernel.
But actually I want to display and analyse the packet fields such as src and dest. addresses and others.
Is there any other way.

Quote:

Originally Posted by angel115

Did you have a look to TCPdump?

Angel

angel115 · 01-12-2009, 10:01 AM

Hi doshirohan,

Did you try the following:

Code:

tcpdump -xx -n -i eth0

It will display the source, destination as well as the content of the packet in HEX.

Sample below:

Code:

15:52:58.903797 IP 10.26.9.120.55259 > 222.75.39.28.48985: . ack 884649 win 2351 <nop,nop,timestamp 798491 809134559>
	0x0000:  000e 0c76 be7b 0013 72a3 8a51 08f0 4500
	0x0010:  0034 b3f9 4000 4006 7ad1 0a1a 0978 d44b
	0x0020:  241c d7db bf59 76ef 945f dfc3 8627 8010
	0x0030:  092f 8fe4 0000 0101 080a 000c 2f1b 303a
	0x0040:  69df
15:52:58.936274 IP 222.75.39.28.48985 > 10.26.9.120.55259: . 884649:886097(1448) ack 1 win 46 <nop,nop,timestamp 809134572 798483>
	0x0000:  0013 72a3 8a51 000e 0c76 be7b 08f0 4500
	0x0010:  05dc 69c8 4000 3806 c75a d44b 241c 0a1a
	0x0020:  0978 bf59 d7db dfc3 8627 76ef 945f 8010
	0x0030:  002e 84a1 0000 0101 080a 303a 69ec 000c
	0x0040:  2f13 35fa 0258 1385 0747 02aa 82c6 7c42
	0x0050:  6085 73de 3e94 303e 13f0 ec3c 547c d898

I hope this will help.
Tell me if that's not what you are looking for.

Best regards,
Angel.

doshirohan · 01-13-2009, 10:34 AM

Hey that's so simple..
Unnecessarily I was going for sockets and all that to read the packet
Thanks angel.

Quote:

Originally Posted by angel115

Hi doshirohan,

Did you try the following:

Code:

tcpdump -xx -n -i eth0

It will display the source, destination as well as the content of the packet in HEX.
Sample below: