Tcpdump: Difference between revisions

Latest revision as of 09:23, 21 June 2024

tcpdump: Trace network traffic, all packets send are reported to standard output (terminal). Cheatsheet

-w <filename> -C 10

Dump raw data to <filename>, create new file after 10 million (not 10MB) bytes are written

-r <filename> -tttt -X

Read packets from <filename>, give absolute time and all data

-i <interface>

Trace <interface> only

-n port 53 and ip6 and host <address>

Do not lookup host or port-names, select only packets from port 53, IPv6 protocol and specified host(address)

In the output Flags are reported that have following meaning:

S (SYN)
F (FIN)
P (PUSH)
R (RST), 
U (URG), 
W (ECN CWR), 
E (ECN-Echo)
. (ACK)
none if no flags are set...

@@ Line 1: / Line 1: @@
+[[Category:Networking]]
 ;tcpdump
-:Trace network traffic, all packets send are reported to standard output (terminal).
+:Trace network traffic, all packets send are reported to standard output (terminal). [https://cdn.comparitech.com/wp-content/uploads/2019/06/tcpdump-cheat-sheet-2.pdf Cheatsheet]
 ;:-w <filename> -C 10
@@ Line 6: / Line 8: @@
 ;:-r  <filename> -tttt -X
 :::Read packets from <filename>, give absolute time and all data
+;: -i <interface>
+:::Trace <interface> only
 ;:-n port 53 and ip6 and host <address>
-:::1     Do not lookup host or port-names, select only packets from port 53, IPv6 protocol and specified host(address)
+:::Do not lookup host or port-names, select only packets from port 53, IPv6 protocol and specified host(address)
 In the output Flags are reported that have following meaning:
-<code>
+ S (SYN)
-S  (SYN),
+ F (FIN)
-F  (FIN),
+ P (PUSH)
-P (PUSH),
+ R (RST),
-R (RST),
+ U (URG),
-U (URG),
+ W (ECN CWR),
-W (ECN CWR),
+ E (ECN-Echo)
-E (ECN-Echo)
+ . (ACK)
-. (ACK)
+ none if no flags are set...
-none if no flags are set...