The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Special Forums > IP Networking
Google UNIX.COM


IP Networking Questions involving TCP/IP, Routers, Hubs, Network protocols, etc go here.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
tcpdump question jinsunnyvale IP Networking 1 01-18-2008 06:04 AM
tcpdump on AIX nymus7 AIX 4 01-16-2008 05:51 PM
R-326: tcpdump iBot Security Advisories (RSS) 0 01-08-2008 09:50 AM
tcpdump ant04 UNIX for Dummies Questions & Answers 2 09-07-2004 03:36 PM
How To Use tcpdump chenhao_no1 High Level Programming 2 04-01-2003 05:15 AM

Reply
 
Submit Tools LinkBack Thread Tools Search this Thread Display Modes
  #1  
Old 07-03-2008
Registered User
 

Join Date: Jul 2008
Posts: 2
i would like to know about tcpdump

i would like to know about tcpdump
i would like to use tcpdump to get information about these
- Date
- time
- source hostname
- source mac address
- source ip address
- destination ip address
- see outbound only
then i use command like this
tcpdump -i le0 -n -q -tttt -e src net 192.168.5.0/24
it will show
2008-07-01 00:04:56.032108 00:0c:29:4c:6d:ff > 00:0c:29:b9:4a:e8, IPv4, length 62: 192.168.5.250.1248 > 64.233.189.99.80: tcp 0
2008-07-01 00:04:56.043136 00:0c:29:4c:6d:ff > 00:0c:29:b9:4a:e8, IPv4, length 60: 192.168.5.250.1247 > 208.109.162.150.80: tcp 0
2008-07-01 00:04:56.043186 00:0c:29:4c:6d:ff > 00:0c:29:b9:4a:e8, IPv4, length 396: 192.168.5.250.1247 > 208.109.162.150.80: tcp 342
2008-07-01 00:04:56.065106 00:0c:29:4c:6d:ff > 00:0c:29:b9:4a:e8, IPv4, length 60: 192.168.5.250.1247 > 208.109.162.150.80: tcp 0
2008-07-01 00:04:56.066702 00:0c:29:4c:6d:ff > 00:0c:29:b9:4a:e8, IPv4, length 60: 192.168.5.250.1247 > 208.109.162.150.80: tcp 0
2008-07-01 00:04:56.088741 00:0c:29:4c:6d:ff > 00:0c:29:b9:4a:e8, IPv4, length 60: 192.168.5.250.1248 > 64.233.189.99.80: tcp 0
ok. i've already know about
- Date
- time
- source mac address
- source ip address
- destination ip address
- see outbound only
but i haven't know "source hostname" yet.
How can i add option for tcpdump to know "source hostname"? ??????
Reply With Quote
Forum Sponsor
  #2  
Old 07-03-2008
Neo's Avatar
Neo Neo is offline
Administrator
 

Join Date: Sep 2000
Location: Asia Pacific
Posts: 4,479
You cannot get hostname directly from an IP packet. Packets carry IP addresses , not hostnames.
Reply With Quote
  #3  
Old 07-17-2008
Registered User
 

Join Date: May 2008
Location: s'pore
Posts: 894
by doing nslookup on the host IP ?
Reply With Quote
Google The UNIX and Linux Forums
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes




All times are GMT -7. The time now is 03:44 PM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited.
The UNIX and Linux Forums Content Copyright ©1993-2008. All Rights Reserved.Ad Management by RedTyger Visit The Complex Event Processing Blog

Content Relevant URLs by vBSEO 3.2.0