tcpdump?

hadimotamedi · 02-20-2010, 12:08 AM

Dear All
I have put tcpdump trace on port 4957 on my Linux server , as the following :
#tcpdump port 4957
I want to obtain the payload data to see what is realy being exchanged between my Linux server and the outside network element . Can you please let me know how I can modify my command ?
Thank you

mattseanbachman · 02-20-2010, 01:17 AM

Quote:

Originally Posted by hadimotamedi

Dear All
I have put tcpdump trace on port 4957 on my Linux server , as the following :
#tcpdump port 4957
I want to obtain the payload data to see what is realy being exchanged between my Linux server and the outside network element . Can you please let me know how I can modify my command ?
Thank you

Well, I think that you might need to run tcpdump as the super-user. At least that's what I need to do on my Ubuntu rig. That way you can run in promiscuous mode and capture everything that hits the server's interface.

sudo tcpdump -s0 -vvv -w dumpfile

So, right there something like that should do it for you. I tacked on the -w dumpfile so that way it writes it to a file instead of dumping it onto the screen. I don't read that fast.

mattseanbachman · 02-20-2010, 01:19 AM

Also I don't know what the heck runs on that port 4957 but you have it right that you can specify a port number with tcpdump. If you need more help I would consult the tcpdump man page, it's not light reading but there's some good stuff in there .

hadimotamedi · 02-20-2010, 04:35 AM

Quote:

Originally Posted by mattseanbachman

Well, I think that you might need to run tcpdump as the super-user. At least that's what I need to do on my Ubuntu rig. That way you can run in promiscuous mode and capture everything that hits the server's interface.

sudo tcpdump -s0 -vvv -w dumpfile

So, right there something like that should do it for you. I tacked on the -w dumpfile so that way it writes it to a file instead of dumping it onto the screen. I don't read that fast.

I tried as the followings :
#tcpdump -s0 -vvv port 4959
But it didn't produce more human readable output from the 'tcpdump port 4959' output . Can you please give me a hint on this ?