How to capture and see packet contents with tcpdump

tcpdump

I am trying to HTTP traffic to port 8007 in a file and then view them later.

# tcpdump -i eth0 -s0 -n -w /tmp/capture port 8007 &
# tcpdump -r /tmp/capture -A | grep '10.2.1.50'

I expected to see packet data in ASCII but that does not happen. What I get instead is something like:

23:03:16.819935 IP 10.2.1.50.8007 > 10.2.1.120.57469: . ack 1369 win 272 <nop,nop,timestamp 188139705 215355175>
23:03:16.819943 IP 10.2.1.120.57469 > 10.2.1.50.8007: P 1369:1592(223) ack 1 win 12 <nop,nop,timestamp 215355175 188139703>
23:03:16.819947 IP 10.2.1.50.8007 > 10.2.1.120.57469: . ack 1592 win 272 <nop,nop,timestamp 188139705 215355175>
23:03:17.029587 IP 10.2.1.50.8007 > 10.2.1.120.57469: P 1:780(779) ack 1592 win 272 <nop,nop,timestamp 188139758 215355175>
23:03:17.029736 IP 10.2.1.50.8007 > 10.2.1.153.49989: F 822:822(0) ack 3494 win 272 <nop,nop,timestamp 188139758 1641992210>
23:03:17.040759 IP 10.2.1.120.57469 > 10.2.1.50.8007: . ack 780 win 15 <nop,nop,timestamp 215355396 188139758>
23:03:17.079305 IP 10.2.1.153.49989 > 10.2.1.50.8007: . ack 823 win 15 <nop,nop,timestamp 1642053303 188139758>

How do I fix the write or read to see the actual content? I have tried other options such as -v but that's not for content. I am using SLES 11 SP2. Is tcpdump the right tool for this?

Thanks a lot.

–EDIT

# tcpdump --version
tcpdump version 3.9.8
libpcap version 0.9-PRE-CVS

I also tried with -X option but still do not see the payload data.

Best Answer

That is the contents. You have probably used some command to filter out content.

Related Solutions

Tcpdump won’t capture entire packet

The guidance on the Wireshark documentation suggests capturing the entire contents of the packet using this command:

$ tcpdump -i <interface> -s 65535 -w <some-file>

Looking at the man page for tcpdump the guidance there suggests that -s0 should be equivalent:

-s

Snarf snaplen bytes of data from each packet rather than the default of 65535 bytes. Packets truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level at which the truncation has occurred. Note that taking larger snapshots both increases the amount of time it takes to process packets and, effectively, decreases the amount of packet buffering. This may cause packets to be lost. You should limit snaplen to the smallest number that will capture the protocol information you're interested in. Setting snaplen to 0 sets it to the default of 65535, for backwards compatibility with recent older versions of tcpdump.

I suspect that you might be losing some of the data due to the sentence in the middle of that guidance, mainly:

Note that taking larger snapshots both increases the amount of time it takes to process packets and, effectively, decreases the amount of packet buffering. This may cause packets to be lost. You should limit snaplen to the smallest number that will capture the protocol information you're interested in.

Searching on how to do this I noticed that others were suggesting a command line similar to this:

$ tcpdump -nnXSs 0 'port 80'

"-nn" makes it not lookup hostnames in DNS and service names (in /etc/services) for respectively faster and cleaner output.
"-X" makes it print each packet in hex and ascii; that's really the useful bit for tracking headers and such
"-S" print absolute rather than relative TCP sequence numbers - If I remember right this is so you can compare tcpdump outputs from multiple users doing this at once
"-s 0" by default tcpdump will only capture the beginning of each packet, using 0 here will make it capture the full packets.

I would suggest adding the -nn to see if that improves your performance, thus causing less data to be buffered, and hopefully protecting more of the data from being potentially dropped. The other switches might help, but it is not clear to me how they would help, if at all, in your situation.

References

How to capture src and dst traffic (both directions) with tcpdump, with one command

To monitor traffic on both directions between host_a and host_b you can use:

# tcpdump -nli eth6 host host_a and host_b

Related Question