I'm using
sudo tcpdump -A -s0 -ien0 port 80 | grep schemas-microsoft >> ~/Downloads/convert.txt
to capture microsoft-schema xmls being sent throught the internet, when tcpdump
is supposed to capture: (for example)
<xml>
<sample>h</sample>
<samp2>j</sample>
</xml>
it only captures:
<xml>
<sample>h</sample
<sam
And stops randomly somewhere in the file. What could this be due to?
Best Answer
The guidance on the Wireshark documentation suggests capturing the entire contents of the packet using this command:
Looking at the man page for
tcpdump
the guidance there suggests that-s0
should be equivalent:I suspect that you might be losing some of the data due to the sentence in the middle of that guidance, mainly:
Searching on how to do this I noticed that others were suggesting a command line similar to this:
/etc/services
) for respectively faster and cleaner output.I would suggest adding the
-nn
to see if that improves your performance, thus causing less data to be buffered, and hopefully protecting more of the data from being potentially dropped. The other switches might help, but it is not clear to me how they would help, if at all, in your situation.References