Sponsored Content
Special Forums IP Networking tcpdump -w file is not capturing all the packets Post 302320721 by shockneck on Thursday 28th of May 2009 06:22:18 PM
Old 05-28-2009
Quote:
Originally Posted by radiatejava
[...]Both the commands were run for 10 secs. In fact I ran the command with -w option for 15 secs but still the captured packets in the dump are are just 6 compared to 26 packets without the file save option. Any reason ? What I can I do to capture all ?

-Satish
Sounds like some bottleneck in the system, perhaps a problem with the buffers. Try
Code:
# tcpdump -l port 22 | tee tdump.dat

instead. Using a pipe should bring relief.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

TCPDump Binary File......

I have a file on a linux box with the extension .gz thats supposed to be a gzip file. when i use gzip -d filename it gives me squares and triangles and you know garbarge. Its a 900 meg file. Is there someway to decode the file and where could I store a 900 meg file for free???? I am going to... (8 Replies)
Discussion started by: pydyer
8 Replies

2. Cybersecurity

Reading and Manipulating captured packets (pflog file)

Hey, I currently have a set of captured sessions thru ethereal, saved in pflog files, basically its a tcpdump, which i need to go thru and sort the applications/protocols in order of the times they were used. I also need to change the headers of the packets, basically the source and destination... (0 Replies)
Discussion started by: PenguinDevil
0 Replies

3. Cybersecurity

How to decipher tcpdump file

Hi, I am stuck with a tricky situation in which one of my applications is flooding the network with UDP messages. The architecture of the application is not supposed to do so. Neither is there any place where the application will go into an infinite loop sending UDP messages over the network. To... (3 Replies)
Discussion started by: diganta
3 Replies

4. UNIX for Dummies Questions & Answers

how to use tcpdump to track packets(mails) ?

I am running 2 Unix machines and trying to use IMAP.pm/Simple.pm perl modules to exchange mails between 2 systems. Mail exchanges is through SMTP(for sending the mail) and IMAP(for retrieving the mails). Somehow it's not working So wanted to check where the packets are and what is their path. I... (3 Replies)
Discussion started by: contactme
3 Replies

5. Linux

Capturing TCPDUMP

Hi, I want to capture TCPDUMP of traffic, I tried doing this but did not find success..can anyone plz correct it. # tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161 bash: tcpdump: command not found # tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host... (5 Replies)
Discussion started by: sureshcisco
5 Replies

6. Shell Programming and Scripting

Help with script, trying to get tcpdump and rotate the file every 300 seconds

Greetings, I just started using scripting languages, im trying to get a tcpdump in a file, change the file name every 5mins ... this is what i have but its not working ... any suggestions? #!/bin/bash # timeout.sh #timestamp format TIMESTAMP=`date -u "+%Y%m%dT%H%M%S"` #tdump =`tcpdump... (3 Replies)
Discussion started by: livewire
3 Replies

7. Infrastructure Monitoring

Capturing bad packets

Hello, SNMP reports from my Linux server a large number of "ipInAddrErrors" on several of my systems. According to one description, these packets are discarded datagrams due to: How do I determine what packets these are? Can tcpdump help? If so, can anyone suggest a filter? (1 Reply)
Discussion started by: otheus
1 Replies

8. IP Networking

Help with capturing/reading total packets on specific port number

Hi guys, I'm using a Linux system(Ubuntu) and I've been trying to find a method to read the total packets received/sent on a specific port (e.g port 80 or port 25) on a local machine. I can read the overall total packets received/sent from the /proc/net/dev file system. But what I can't do is... (2 Replies)
Discussion started by: lildee
2 Replies

9. IP Networking

Capture packets (TcpDump) and forwarding them

Hi, I want to capture a certain type of packets (selected according to the protocol) coming to my PC and then transmit them to another PC. I had the idea to use tcpdump to filter input packets and extract those chosen. Well my questions are: 1- after filtering input packets, those that have not... (1 Reply)
Discussion started by: ziedf
1 Replies

10. Shell Programming and Scripting

Capturing time stamp in file name

I have a file that is created via a perl script where the file is named like so: 01-07-2016_10:17:08. I am running a shell script that needs to take this file and print it. I can capture the date portion fine, but I am unsure how to capture the time stamp, since there will be a difference from what... (1 Reply)
Discussion started by: ldorsey
1 Replies
DRIFTNET(1)						      General Commands Manual						       DRIFTNET(1)

NAME
driftnet - capture images from network traffic and display them in an X window; optionally, capture audio streams and play them. SYNOPSIS
driftnet [options] [filter code] DESCRIPTION
Driftnet watches network traffic, and picks out and displays JPEG and GIF images for display. It is an horrific invasion of privacy and shouldn't be used by anyone anywhere. It has been described as `a graphical tcpdump(8)', `EtherPeg for Unix', and called all sorts of nasty names by people on Freshmeat. It is also possible to use driftnet to capture MPEG audio data from the network and play it through a player such as mpg123(1). Images may be saved by clicking on them. OPTIONS
-h Print a summary of usage. -v Print additional details of packets captured to the terminal. -b Beep when a new image is displayed. -i interface Listen to packets on interface. By default, driftnet will try to pick up traffic on all interfaces, but this does not work with all versions of pcap(3); on such systems, an interface must be specified. On some systems, driftnet can only use promiscuous mode if an interface is specified. -f file Instead of listening on an interface, read captured packets from a pcap(3); dump file; file can be a named pipe for use with Kismet or similar. -p Do not put the interface into promiscuous mode. -a Operate in `adjunct mode', where driftnet gathers images for use by another program, such as Jamie Zawinski's webcollage. In this mode, no window is displayed; images are captured and saved in a temporary directory, and their names written on standard output. -m number In adjunct mode, silently drop images if there are more than number in the temporary directory. It is assumed that another process will delete images which it has processed. -x prefix The filename prefix to use when saving images, by default `driftnet-'. -d directory Use directory to store temporary files. Driftnet will clear this directory of its own temporary files on exit, but will not delete the directory or any other files. -s Attempt to capture streamed audio data from the network, and either play it or, in adjunct mode, save it in files. At present this only works with MPEG data. -S Capture streamed audio data only, ignoring images. -M command Use the named command to play MPEG audio data. The command, which is executed using the shell, should accept MPEG frames on standard input. The default is `mpg123 -'. filter code Additional filter code to restrict the packets captured, in the libpcap syntax. User filter code is evaluated as `tcp and (filter code)'. SEE ALSO
tcpdump(8), pcap(3), webcollage(1), mpg123(1), http://www.etherpeg.org/, http://freshmeat.net/projects/driftnet/, http://www.ex-parrot.com/~chris/driftnet/. AUTHOR
Chris Lightfoot <chris@ex-parrot.com> VERSION
Driftnet, version 0.1.6. $Id: driftnet.1.in,v 1.7 2004/04/26 14:42:36 chris Exp $ COPYING
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MER- CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. DRIFTNET(1)
All times are GMT -4. The time now is 06:04 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy