Tue, 04 Oct 2005

tethereal and tcpdump

tethereal -R aim -i eth1
    // captures aim packets on interface eth1

tethereal -R ip.src==10.10.10.157 -i eth1
    // captures packets on interface eth1
    // that come from 10.10.10.157

tcpdump -a -s 0 -i eth1 -w fn host sakura.hawkwood
    // captures all packets to/from sakura.hawkwood
    // write everything to file fn
    // listens on interface eth1 only
    // snaplen of packets set to zero to use the length
        needed to capture the whole packet and not truncate
    // -a attempts to convert addresses to names

tethereal -r fn | grep 'ABC' | more
    // use tethereal to read a tcpdump file fn and 
    // look for occurances of 'ABC'

Posted at: 00:00 | category: /commands | Comments ()