dacaprice.com from fitness to technology. mostly technology. sometimes fitness.

dump packets with tcpdump

I always forget the parameters for this and have to look them up in the man page, so enough of that:

 tcpdump -nnXSs 0 host hostname (or IP)

• "-nn" makes it not lookup hostnames in DNS and service names (in /etc/services) for respectively faster and cleaner output.
• "-X" makes it print each packet in hex and ascii; that's really the useful bit for tracking headers and such
• "-S" print absolute rather than relative TCP sequence numbers - If I remember right this is so you can compare tcpdump outputs from multiple users doing this at once
• "-s 0" by default tcpdump will only capture the beginning of each packet, using 0 here will make it capture the full packets.