03-25-2010
According to the man page that means that either you're not on Linux >= 2.2, or you're trying to capture in promiscuous mode:
Quote:
-i Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback). Ties are broken by choosing the earliest match.
On Linux systems with 2.2 or later kernels, an interface argument of "any" can be used to capture packets from all interfaces. Note that captures on the "any" device will not be done in promiscuous mode.
10 More Discussions You Might Find Interesting
1. Programming
I have two net-card. one is 172.16.24.99(ENG) ,another is 172.16.25.99(ENG-B). Both masks is 255.255.255.0.
I will monitor data on the tcp port 8055 in ENG, How do I set option of tcpdump command (2 Replies)
Discussion started by: chenhao_no1
2 Replies
2. UNIX for Dummies Questions & Answers
does anybody know what the -d -dd and -ddd options are used for ?
thanks (2 Replies)
Discussion started by: ant04
2 Replies
3. Shell Programming and Scripting
I wrote a short BASH script to run tcpdump and save the output to a log file for when I'm away from my desk. The script runs fine normally, but fails to start in cron. Any ideas?
#!/bin/bash
today=`date +%Y%m%d`
tcpdump -i eth0 -s 1500 -w ${today}.cap &
exit (5 Replies)
Discussion started by: paulzeromi
5 Replies
4. Cybersecurity
i would like to know about tcpdump
i would like to use tcpdump to get information about these
- Date
- time
- source hostname
- source mac address
- source ip address
- destination ip address
- see outbound only
then i use command like this
tcpdump -i le0 -n -q -tttt -e src net... (0 Replies)
Discussion started by: chamnanpol
0 Replies
5. IP Networking
i would like to know about tcpdump
i would like to use tcpdump to get information about these
- Date
- time
- source hostname
- source mac address
- source ip address
- destination ip address
- see outbound only
then i use command like this
tcpdump -i le0 -n -q -tttt -e src net... (2 Replies)
Discussion started by: chamnanpol
2 Replies
6. Shell Programming and Scripting
I'm new to the Unix/Linux world. I have taken classes and played with a few simple scripts but never had a real world application. Here is my problem.
What I need to do is every 15min between 8am and 5pm, run
tcpdump -s 2000 -w flowroute-0000.pcap
where the "0000" is the current time.
... (4 Replies)
Discussion started by: Nasasdge
4 Replies
7. IP Networking
Hi,
I am trying to capture manually crafted IP packets, created using Scapy, to a pcap file that can later be replayed using tcpreplay.
When using wireshark, I can successfully capture these packets and view them in wireshark.
However, when using tcpdump, these packets are then shown in... (2 Replies)
Discussion started by: yotamhc
2 Replies
8. Debian
Hi.
Need Help with TcpDump
Trying to sniff associatio-request with tcpdump but when i run this tcpdump -i eth0 wlan subtype assoc-req i get this error
can anyone help me with this error ? Thanks alot !!:) (1 Reply)
Discussion started by: SoulZB
1 Replies
9. Cybersecurity
Hello everyone, so I'm getting this tcpdump, and it looks like..quite a mess... Can anyone decipher this? I can tell that one IP is requesting DNS info? but I'm having trouble finding out what some of the fields actually mean..
19:44:50.707637 IP 66.81.1.252.53 > 64.147.113.139.28638: 52313... (4 Replies)
Discussion started by: Lost in Cyberia
4 Replies
10. IP Networking
I've recently started learning to use TCPdump, and I find it pretty interesting. There's one thing I don't understand. When I tell it to capture packets on, say, the WiFi interface en1, it often captures packets sent or received by other hosts on the network. How can it do this? My... (3 Replies)
Discussion started by: Ultrix
3 Replies
ttt(1) net ttt(1)
NAME
ttt - Tele Traffic Tapper - a standalone program for local, real-time, graphical traffic-monitoring.
SYNTAX
ttt [-interface device] [-interval ms] [-dumpfile file [-speed N]] [-yscale (K|M|n)]
DESCRIPTION
ttt is the standalone traffic monitor program in the ttt program suite. It displays trafic-data of a local interface.
To run ttt, you must be "root" on most systems since only root is allowed to access the network filter device.
The ttt program suite is yet another descendant of tcpdump but it is capable of real-time, graphical, local and remote traffic-monitoring.
It won't replace tcpdump, rather, it helps you find out what to look into with tcpdump.
OPTIONS
-interface device
specifies the interface for packet capture. If not specified, the default interface is chosen.
-interval ms
Sets the interval in Milliseconds. If omitted, a interval of 1000 msec. is used as default.
-dumpfile file [-speed N]
use a dumpfile (produced by "tcpdump -w") as input. The speed option specifies the acceleration factor of the replay speed.
-yscale ('K'|'M'|n)
change the scale of y-axis. 'K' and 'M' represent 1000 and 1000000 respectively.
EXAMPLES
To run this program the standard way type:
ttt
To listen only on interface eth0:
ttt -interface eth0
AUTHORS
ttt was written by Kenjiro Cho < kjc@csl.sony.co.jp>.
This manual page was written by Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>, for the Debian GNU/Linux system (but may be
used by others).
SEE ALSO
tttview(1), tttprobe(1)
Kenjiro Cho 1.7 ttt(1)