LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 12-15-2017, 08:41 AM   #1
shroman
LQ Newbie
 
Registered: Dec 2017
Posts: 3

Rep: Reputation: Disabled
Question How to capture udp packet with tcpdump started by xinetd?


Hi,
I am trying to set up a xinetd for running shell script by receiving a udp packet on port 8012. It works. But in shell script I want to extract data from packet with tcpdump. But tcpdump recieve only second packet.

By first packet xinetd starts my script and only second packet go to tcpdump.

Maybe there is another way to do this?

Code:
# /etc/xinetd.d/stream_control
service stream_control
{
    disable = no
    type = UNLISTED
    port = 8012
    socket_type = dgram
    protocol = udp
    flags = IPv4
    wait = yes
    user = root
    server = /home/user/test.sh
    log_type = SYSLOG daemon
}
test.sh:

Code:
#!/bin/bash
tcpdump -Q in udp port 8012 -A -c 1 >> /home/user/test.txt
 
Old 12-15-2017, 09:31 AM   #2
Turbocapitalist
Senior Member
 
Registered: Apr 2005
Distribution: Ubuntu, Devuan, OpenBSD
Posts: 3,079
Blog Entries: 3

Rep: Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330Reputation: 1330
Make sure that the tcpdump settings work on their own before putting them in a script.

Code:
tcpdump -w /home/user/test.txt -A -c 1 -Q in udp port 8012
The option to write raw packets to a file is -w.
 
Old 12-18-2017, 05:18 AM   #3
shroman
LQ Newbie
 
Registered: Dec 2017
Posts: 3

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Turbocapitalist View Post
Make sure that the tcpdump settings work on their own before putting them in a script.

Code:
tcpdump -w /home/user/test.txt -A -c 1 -Q in udp port 8012
The option to write raw packets to a file is -w.
Thank you, but the same behavior.
If I run tcpdump -w /home/user/test.txt -A -c 1 -Q in udp port 8012 in terminal, tcpdump captures 1-st packet. But runned from xinetd captures only second packet.
 
Old 12-28-2017, 11:19 AM   #4
DavideDG
LQ Newbie
 
Registered: Dec 2017
Location: Italy
Distribution: Ubuntu
Posts: 3

Rep: Reputation: Disabled
Quote:
Originally Posted by shroman View Post
Thank you, but the same behavior.
If I run tcpdump -w /home/user/test.txt -A -c 1 -Q in udp port 8012 in terminal, tcpdump captures 1-st packet. But runned from xinetd captures only second packet.
Hi,

the reason the 1st packet is not being captured is that you are discarding it
The 1st packet makes xinetd call your script, which in turn fires up tcpdump on default interface waiting to capture a total of 1 packet.
Meanwhile, the 1st packet is on STDIN, waiting to be used, but you are not telling anyone to use it, you are just preparing tcpdump ... for the next packet, which arrives shortly after, causing:
- the 1st tcpdump process to capture on eth0, and write to file
- another tcpdump process to spawn, ready for yet another packet (what will be the 3rd packet)


Also, xinetd will actually mask all the connection details, giving you (on STD-in!) only the payload.

So if you want to still use xinetd and inspect the payload, you might want to use simply this in your script:
Code:
#!/bin/bash
cat - >> /home/user/test.txt

HTH!
Bye!
 
1 members found this post helpful.
Old 12-29-2017, 09:41 AM   #5
shroman
LQ Newbie
 
Registered: Dec 2017
Posts: 3

Original Poster
Rep: Reputation: Disabled
Thumbs up

Quote:
Originally Posted by DavideDG View Post
xinetd will actually mask all the connection details, giving you (on STD-in!) only the payload.

So if you want to still use xinetd and inspect the payload, you might want to use simply this in your script:
Code:
#!/bin/bash
cat - >> /home/user/test.txt
Thank you DavideDG. It works!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
A packet filter using libipq which uses ether type field to capture the packet can26_manish Programming 2 10-16-2007 05:35 AM
Want to know method wireshark or tcpdump to capture packet? haxpor Programming 1 04-12-2007 01:08 AM
how do i read the data in the packet that i have captured after packet capture? gajaykrishnan Programming 23 04-19-2006 05:09 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 09:12 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration