Linux

Hi,

I want to capture TCPDUMP of traffic, I tried doing this but did not find success..can anyone plz correct it.

[root@labdevice1 osuresh]# tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161
bash: tcpdump: command not found

[root@labdevice1 osuresh]# tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22
bash: tcpdump: command not found

[root@labdevice1 osuresh]# tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump port 161
bash: tcpdump: command not found

Appreciate all responses.

appears tcpdump is not installed or not in the path.

try: /usr/sbin/tcpdump

or install it.

I could observe tcpdump in /usr/sbin/
but not sure if I need to execute:
tcpdump -s0 -vv -w /usr/sbin/tcpdump host 10.12.10.22 && port 161


[root@labdevice1 sbin]# tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161
bash: tcpdump: command not found

Do you have permissions to use it? (execute)

Also, why not try the full path in your command?

Code:

[root@labdevice1 sbin]# tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161
bash: tcpdump: command not found

That would only work if you had "." in your environment variable PATH. Anyway, sbin is not in your PATH and it should be. Anyway, try doing ./tcpdump in your sbin directory, or use the full path /usr/sbin/tcpdump.

There's another issue with your dump command
I would guess by merely looking at it.
If you insist on using && I would think you will have to escape each ampersand,
or single quote the entire tcpdump logical expression
to prevent the probably non-existing command port 161 from being tried to be executed by the shell after the preceding tcpdump has finished successfully.
If you are too lazy to escape you could as well replace && by and.
Also, as far as I remember tcpdump will grab the first NIC if you don't explicitly tell it
by -i ethN which one to use.
You could as well use -i any to let it sniff on every available NIC
but then it wouldn't set them into promiscuous mode,
which probably anyway would be wiser altogether because you are generally only interested in packets destined for your host.
So it's save to add -p.
Please no, (I'm not even sure if tcpdump would allow such stupid abuse)
but by that you would tell it to overwrite its own executable with the dump it filtered!
What the others meant was to give the full path to the command
in case your root user hadn't /usr/sbin in his $PATH
which seems quite unlikely anyway.
e.g.

Code:

# /usr/sbin/tcpdump -p -i eth0 -s0 -w /home/osuresh/test_tcp_dump 10.12.10.22 and port 161

Given the difficulties you already encounter properly executing the command
I am afraid I am a bit suspicious if you know what to do with the dump in the end?