grantpullen/tcpdump_view.md

Created June 22, 2020 11:47

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Select an option

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/grantpullen/f8e8a889b65345ddcb48aef4449a0e94.js"></script>
Save grantpullen/f8e8a889b65345ddcb48aef4449a0e94 to your computer and use it in GitHub Desktop.

Download ZIP

Raw

tcpdump_view.md

Display live HTTP traffic to console on a specified port for all interfaces

tcpdump -A -i any 'port 1333 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

The example above captures all TCP traffic at port 133 and filter out the TCP session setup (SYN / FIN / ACK)

-A Print each packet (minus its link level header) in ASCII. Handy for capturing web pages.
-i any Include all interfaces
port 1333 Only look at TCP traffic to/from port 1333
(((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) filter out the TCP session setup (SYN / FIN / ACK)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment