Re: can tcpdump capture more than packet headers?

thanks guys - the -X option looks good - gave it a quick go before but
still seemed to be just packet headers. Will give it a good test this
evening.
Chris Lowth wrote:
Allen Kistler wrote:
eddie wrote:

No excuses for ignorance but I have been playing with tcpdump to
capture application data passing between two computers (no switch). All
that seems to be displayed is packet header information. The
client(-server) application is communicating using the netbios-ssn
(netbeui) protocol. I have tried increasing the packet size (using -s)
still no joy. Can I capture data from the 'higher' layers(above network
layer on osi model)?


tcpdump can capture it all.
I'm uncertain how much tcpdump can dissect of NetBEUI, though.
Use -v, -vv, or -vvv to display additional info.
You may need to write to a file, then analyze with WireShark (or just
capture with WireShark).

try -X or -XX with -s<length> to specify the largest pkt size you expect.
See "man tcpdump".

C

.

Relevant Pages

  • Re: Network traffic monitoring: BSD monitor & verifying encryption
    ... I'm only used Wireshark and Ethereal to inspect network traffic, ... you can use tcpdump to ... capture traffic that you can later feed into wireshark for analysis. ... in the traffic that will indicate encryption (e.g., ...
    (freebsd-questions)
  • Re: packet capture
    ... >Subject: Re: packet capture ... >I agree tcpdump -w somefile is great. ... >format, so you can process it later with tcpdump, snort, ngrep, or ... >Then snort for analyzing the packets (okay tcpdump does this too, ...
    (Security-Basics)
  • Re: No packet loss, just incorrect sequence...
    ... As others have mentioned you should definitely use tcpdump to capture some traffic while downloading something. ... Not only will this clearly diagnose the TCP performance problem but it will irrefutably demonstrate it to your ISP. ...
    (uk.comp.sys.mac)
  • Some problems in capturing traffic with tcpdump at ~ 1 Gbps
    ... hyperthreading and 2 Gbytes RAM size) ... Mbps (we have some traffic samples acquired with tcpdump). ... improvement in the packet capture process. ... With this configuration we can capture 1 Gbyte of traffic, ...
    (comp.os.linux.networking)
  • Re: Network traffic capture, and rotating files with compression
    ... > I am trying to capture traffic on my network - really the Source IP, ... > writing to make it log to file, stop, compress then carry on in a new file. ... First write a script that wraps up the starting and stopping of tcpdump. ...
    (comp.os.linux.networking)