05-22-2009
Quote:
Originally Posted by
radiatejava
This is not the answer I am looking for. I believe tcpdump is a widely used free utility to capture network packets in a file. Can someone else update me on using tcpdump to capture all the packets in a file ?
In the future, if you want good answers to your questions, please do not use small fonts or colored fonts.
I, for one, find your original post very difficult to read. I think most readers will quickly go to "next post" when they encounter a post that is an eye strain
![Wink Smilie](https://www.unix.com/images/smilies/wink.gif)
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
I have a file on a linux box with the extension .gz thats supposed to be a gzip file. when i use gzip -d filename
it gives me squares and triangles and you know garbarge. Its a 900 meg file. Is there someway to decode the file and where could I store a 900 meg file for free???? I am going to... (8 Replies)
Discussion started by: pydyer
8 Replies
2. Cybersecurity
Hey,
I currently have a set of captured sessions thru ethereal, saved in pflog files, basically its a tcpdump, which i need to go thru and sort the applications/protocols in order of the times they were used. I also need to change the headers of the packets, basically the source and destination... (0 Replies)
Discussion started by: PenguinDevil
0 Replies
3. Cybersecurity
Hi,
I am stuck with a tricky situation in which one of my applications is flooding the network with UDP messages. The architecture of the application is not supposed to do so. Neither is there any place where the application will go into an infinite loop sending UDP messages over the network. To... (3 Replies)
Discussion started by: diganta
3 Replies
4. UNIX for Dummies Questions & Answers
I am running 2 Unix machines and trying to use IMAP.pm/Simple.pm perl modules to exchange mails between 2 systems.
Mail exchanges is through SMTP(for sending the mail) and IMAP(for retrieving the mails).
Somehow it's not working So wanted to check where the packets are and what is their path. I... (3 Replies)
Discussion started by: contactme
3 Replies
5. Linux
Hi,
I want to capture TCPDUMP of traffic, I tried doing this but did not find success..can anyone plz correct it.
# tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161
bash: tcpdump: command not found
# tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host... (5 Replies)
Discussion started by: sureshcisco
5 Replies
6. Shell Programming and Scripting
Greetings, I just started using scripting languages,
im trying to get a tcpdump in a file, change the
file name every 5mins ... this is what i have but its
not working ... any suggestions?
#!/bin/bash
# timeout.sh
#timestamp format
TIMESTAMP=`date -u "+%Y%m%dT%H%M%S"`
#tdump =`tcpdump... (3 Replies)
Discussion started by: livewire
3 Replies
7. Infrastructure Monitoring
Hello,
SNMP reports from my Linux server a large number of "ipInAddrErrors" on several of my systems. According to one description, these packets are discarded datagrams due to:
How do I determine what packets these are? Can tcpdump help? If so, can anyone suggest a filter? (1 Reply)
Discussion started by: otheus
1 Replies
8. IP Networking
Hi guys,
I'm using a Linux system(Ubuntu) and I've been trying to find a method to read the total packets received/sent on a specific port (e.g port 80 or port 25) on a local machine. I can read the overall total packets received/sent from the /proc/net/dev file system. But what I can't do is... (2 Replies)
Discussion started by: lildee
2 Replies
9. IP Networking
Hi,
I want to capture a certain type of packets (selected according to the protocol) coming to my PC and then transmit them to another PC. I had the idea to use tcpdump to filter input packets and extract those chosen. Well my questions are:
1- after filtering input packets, those that have not... (1 Reply)
Discussion started by: ziedf
1 Replies
10. Shell Programming and Scripting
I have a file that is created via a perl script where the file is named like so: 01-07-2016_10:17:08. I am running a shell script that needs to take this file and print it. I can capture the date portion fine, but I am unsure how to capture the time stamp, since there will be a difference from what... (1 Reply)
Discussion started by: ldorsey
1 Replies
LEARN ABOUT FREEBSD
if_enc
ENC(4) BSD Kernel Interfaces Manual ENC(4)
NAME
enc -- Encapsulating Interface
SYNOPSIS
To compile this driver into the kernel, place the following line in your kernel configuration file:
device enc
DESCRIPTION
The enc interface is a software loopback mechanism that allows hosts or firewalls to filter ipsec(4) traffic using any firewall package that
hooks in via the pfil(9) framework.
The enc interface allows an administrator to see incoming and outgoing packets before and after they will be or have been processed by
ipsec(4) via tcpdump(1).
The ``enc0'' interface inherits all IPsec traffic. Thus all IPsec traffic can be filtered based on ``enc0'', and all IPsec traffic could be
seen by invoking tcpdump(1) on the ``enc0'' interface.
What can be seen with tcpdump(1) and what will be passed on to the firewalls via the pfil(9) framework can be independently controlled using
the following sysctl(8) variables:
Name Defaults Suggested
net.enc.out.ipsec_bpf_mask 0x00000003 0x00000001
net.enc.out.ipsec_filter_mask 0x00000001 0x00000001
net.enc.in.ipsec_bpf_mask 0x00000001 0x00000002
net.enc.in.ipsec_filter_mask 0x00000001 0x00000002
For the incoming path a value of 0x1 means ``before stripping off the outer header'' and 0x2 means ``after stripping off the outer header''.
For the outgoing path 0x1 means ``with only the inner header'' and 0x2 means ``with outer and inner headers''.
incoming path |------|
---- IPsec processing ---- (before) ---- (after) ----> | |
| Host |
<--- IPsec processing ---- (after) ----- (before) ---- | |
outgoing path |------|
Most people will want to run with the suggested defaults for ipsec_filter_mask and rely on the security policy database for the outer head-
ers.
EXAMPLES
To see the packets the processed via ipsec(4), adjust the sysctl(8) variables according to your need and run:
tcpdump -i enc0
SEE ALSO
tcpdump(1), bpf(4), ipf(4), ipfw(4), ipsec(4), pf(4), tcpdump(8)
BSD
November 28, 2007 BSD