Hi everyone.

I'm trying to find a way (tcpdump command parameter?) to read ALL data from a pcap file on the console.

For example, considering I want to sniff every query and response functions between 2 hosts.

I've tried with "tcpdump -A" and other option but none of them present the entire information, like Wireshark GUI does.

Any ideias?

Hello,

You need to use the -r <filename> option with tcpdump. a pcap file generally is what you get with the -w option of tcpdump.

For example: to see the traffic between hosts A and B, I use:

tcpdump -r <pcapfile> -n host A or host B

-jason

I've used "-r" before but that shows very little info. I need something that is able to give me the entire information, as seen with Wireshark!

For example, in Wireshark we get detailed info when the following sections are expanded, for some Protocol:
- Frame data
- Ethernet data
- IP data
- TCP/UDP data
- Protocol data

I want this in a way that I can read from the CLI.

Hello,

You might need to run several different dumps to see what you want.

the -e option will print the link-level headers: this will show the source and destination mac addresses.
not sure what you mean by "frame data"
ip, tcp, and udp can all be filtered upon. if tcpdump doesn't show how to do this, read the man page on pcap-filter.

the -v options will print out more data, but this depends on the version of tcpdump.

The big issue to remember though is even though the data is there, it's hard to keep things in context. There are also lots of examples and tutorials online, such as tcpdump's website.

--jason

tshark is probably what you are looking for.


http://www.wireshark.org/docs/man-pages/tshark.html

1 members found this post helpful.

Hello,

I like 0.o's reply: I hadn't realized there was a console-based wireshark.

--jason

You might also like this:

tcpdump -As0 -vvnn -r <pcap>

1 members found this post helpful.