Home / server / Questions / 290701
Accepted
Eamorr
Asked: 2011-07-16 03:55:58 +0800 CST

tcpdump - just output the packet contents line by line

  • 772

I'm trying to use tcpdump on the DEFCON packets.

Here's the command I'm using:

tcpdump -qns 0 -X -r ulogd.eth0.pcap

And here's the output I'm getting:

10:39:12.356410 IP 192.168.103.2.3101 > 192.168.102.2.80: tcp 0
    0x0000:  4500 0028 0557 4000 7f06 a823 c0a8 6702  E..(.W@....#..g.
    0x0010:  c0a8 6602 0c1d 0050 2463 0fbe 8854 e419  ..f....P$c...T..
    0x0020:  5010 4296 71ec 0000                      P.B.q...
10:39:27.223199 IP 192.168.103.2.3101 > 192.168.102.2.80: tcp 52
    0x0000:  4500 005c 055e 4000 7f06 a7e8 c0a8 6702  E..\.^@.......g.
    0x0010:  c0a8 6602 0c1d 0050 2463 0fbe 8854 e419  ..f....P$c...T..
    0x0020:  5018 4296 0d82 0000 4745 5420 2f2f 726f  P.B.....GET.//ro
    0x0030:  756e 6431 3832 2e78 6d6c 2048 5454 502f  und182.xml.HTTP/
    0x0040:  312e 310d 0a48 6f73 743a 2031 3932 2e31  1.1..Host:.192.1
    0x0050:  3638 2e31 3032 2e32 0d0a 0d0a            68.102.2....
10:39:27.224154 IP 192.168.102.2.80 > 192.168.103.2.3101: tcp 474
    0x0000:  4500 0202 90d3 4000 3f06 5acd c0a8 6602  E.....@.?.Z...f.
    0x0010:  c0a8 6702 0050 0c1d 8854 e419 2463 0ff2  ..g..P...T..$c..
    0x0020:  5018 16d0 6b2f 0000 4854 5450 2f31 2e31  P...k/..HTTP/1.1
    0x0030:  2034 3034 204e 6f74 2046 6f75 6e64 0d0a  .404.Not.Found..
    0x0040:  4461 7465 3a20 4d6f 6e2c 2030 3420 4175  Date:.Mon,.04.Au
    0x0050:  6720 3230 3033 2030 393a 3339 3a32 3720  g.2003.09:39:27.
    0x0060:  474d 540d 0a53 6572 7665 723a 2041 7061  GMT..Server:.Apa
    0x0070:  6368 652f 312e 332e 3236 2028 556e 6978  che/1.3.26.(Unix
    0x0080:  2920 4465 6269 616e 2047 4e55 2f4c 696e  ).Debian.GNU/Lin
    0x0090:  7578 0d0a 5472 616e 7366 6572 2d45 6e63  ux..Transfer-Enc
    0x00a0:  6f64 696e 673a 2063 6875 6e6b 6564 0d0a  oding:.chunked..
    0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465  Content-Type:.te
    0x00c0:  7874 2f68 746d 6c3b 2063 6861 7273 6574  xt/html;.charset
    0x00d0:  3d69 736f 2d38 3835 392d 310d 0a0d 0a31  =iso-8859-1....1
    0x00e0:  3137 0d0a 3c21 444f 4354 5950 4520 4854  17..<!DOCTYPE.HT
    0x00f0:  4d4c 2050 5542 4c49 4320 222d 2f2f 4945  ML.PUBLIC."-//IE
    0x0100:  5446 2f2f 4454 4420 4854 4d4c 2032 2e30  TF//DTD.HTML.2.0
    0x0110:  2f2f 454e 223e 0a3c 4854 4d4c 3e3c 4845  //EN">.<HTML><HE
    0x0120:  4144 3e0a 3c54 4954 4c45 3e34 3034 204e  AD>.<TITLE>404.N
    0x0130:  6f74 2046 6f75 6e64 3c2f 5449 544c 453e  ot.Found</TITLE>
    0x0140:  0a3c 2f48 4541 443e 3c42 4f44 593e 0a3c  .</HEAD><BODY>.<
    0x0150:  4831 3e4e 6f74 2046 6f75 6e64 3c2f 4831  H1>Not.Found</H1
    0x0160:  3e0a 5468 6520 7265 7175 6573 7465 6420  >.The.requested.
    0x0170:  5552 4c20 2f2f 726f 756e 6431 3832 2e78  URL.//round182.x
    0x0180:  6d6c 2077 6173 206e 6f74 2066 6f75 6e64  ml.was.not.found
    0x0190:  206f 6e20 7468 6973 2073 6572 7665 722e  .on.this.server.
    0x01a0:  3c50 3e0a 3c48 523e 0a3c 4144 4452 4553  <P>.<HR>.<ADDRES
    0x01b0:  533e 4170 6163 6865 2f31 2e33 2e32 3620  S>Apache/1.3.26.
    0x01c0:  5365 7276 6572 2061 7420 7363 6f72 652e  Server.at.score.
    0x01d0:  726f 6f74 6675 2e6a 7020 506f 7274 2038  rootfu.jp.Port.8
    0x01e0:  303c 2f41 4444 5245 5353 3e0a 3c2f 424f  0</ADDRESS>.</BO
    0x01f0:  4459 3e3c 2f48 544d 4c3e 0a0d 0a30 0d0a  DY></HTML>...0..
    0x0200:  0d0a                                     ..
10:39:27.406315 IP 192.168.103.2.3101 > 192.168.102.2.80: tcp 0
    0x0000:  4500 0028 055f 4000 7f06 a81b c0a8 6702  E..([email protected].
    0x0010:  c0a8 6602 0c1d 0050 2463 0ff2 8854 e5f3  ..f....P$c...T..
    0x0020:  5010 40bc 71b8 0000                      [email protected]...

I'm not interested in the stuff to the left (hex representations and the IP addresses). I just want the content. Also, what are all those dots?

linux ubuntu tcpdump

2 Answers

  1. The dots are non-printable characters; anything outside of the range ASCII 32-126 (or thereabouts). You're getting the hexdump representation because you used the -X option; if you instead use the -A option, you'll get just the ASCII representation.

    • 11
  2. Best Answer

    Some nice alternatives to the -A switch womble pointed out:

    tcpflow will read a pcap file and split the TCP connections into separate files. Make sure you use a temp directory as it will split it into separate files for each connection.

    tcpdump -s0 -w capfile
...
mkdir tmp && cd tmp
tcpflow -r ../capfile

    You can also get something from tcpflow very similar to tcpdump -A, without splitting to different files:

    tcpflow -C -r capfile

    Personally, I find using wireshark and its Follow TCP stream option the easiest to read as it color-codes each side of the conversation. You can capture with wireshark directly or read captures made with tcpdump.

    • 4