Hide

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.


If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

Hide

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

Hide

News

2011-03-12 - Confoo 2011 presentation
Slides are available from the commandlinefu presentation at Confoo 2011: http://presentations.codeinthehole.com/confoo2011/
2011-01-04 - Moderation now required for new commands
To try and put and end to the spamming, new commands require moderation before they will appear on the site.
2010-12-27 - Apologies for not banning the trolls sooner
Have been away from the interwebs over Christmas. Will be more vigilant henceforth.
2010-09-24 - OAuth and pagination problems fixed
Apologies for the delay in getting Twitter's OAuth supported. Annoying pagination gremlin also fixed.
Hide

Tags

Hide

Functions

Commands tagged tcpdump from sorted by
Terminal - Commands tagged tcpdump - 21 results
sudo tcpdump -i wlan0 -n ip | awk '{ print gensub(/(.*)\..*/,"\\1","g",$3), $4, gensub(/(.*)\..*/,"\\1","g",$5) }' | awk -F " > " '{print $1"\n"$2}'
tcpdump host <IP> -nXXv -s0 -w file.pcap
tcpdump -i eth0 -w - | ssh forge.remotehost.com -c arcfour,blowfish-cbc -C -p 50005 "cat - | gzip > /tmp/eth0.pcap.gz"
2013-05-30 07:41:22
User: bhbmaster
Functions: ssh tcpdump
Tags: ssh tcpdump gzip
0

NOTE: When opening the files you might need to strip the very top line with notepad++ as its a mistake header

This is useful when the local machine where you need to do the packet capture with tcpdump doesn?t have enough room to save the file, where as your remote host does

tcpdump -i eth0 -w - | ssh forge.remotehost.com -c arcfour,blowfish-cbc -C -p 50005 "cat - | gzip > /tmp/eth0.pcap.gz"

Your @ PC1 doing a tcpdump of PC1s eth0 interface and its going to save the output @ PC2 who is called save.location.com to a file /tmp/eth0-to-me.pcap.gz again on PC2

More info @: http://www.kossboss.com/linuxtcpdump1

tcpdump -i eth0 -w - | ssh savelocation.com -c arcfour,blowfish-cbc -C -p 50005 "cat - > /tmp/eth0.pcap"
2013-05-30 07:33:48
User: bhbmaster
Functions: ssh tcpdump
Tags: ssh tcpdump
0

This is useful when the local machine where you need to do the packet capture with tcpdump doesn?t have enough room to save the file, where as your remote host does

tcpdump -i eth0 -w - | ssh savelocation.com -c arcfour,blowfish-cbc -C -p 50005 "cat - > /tmp/eth0.pcap"

Your @ PC1 doing a tcpdump of PC1s eth0 interface and its going to save the output @ PC2 who is called save.location.com to a file /tmp/ppp1-to-me.pcap.gz again on PC2

More info @: http://www.kossboss.com/linuxtcpdump1

tcpdump -s 1024 -l -A -n host 192.168.9.56
2013-02-02 22:29:52
User: wejn
Functions: host tcpdump
Tags: http tcpdump
-1

This is a better way to do the "src X or dst X" filter; plus you might not want to bother with DNS lookups (-n).

tcpdump -s 1024 -l -A src 192.168.9.56 or dst 192.168.9.56
2013-02-01 15:03:12
User: bleiva
Functions: tcpdump
Tags: http tcpdump
0

Where src or dst is the host that you want to view the HTTP header.

tcpdump -ntr NAME_OF_CAPTURED_FILE.pcap 'tcp[13] = 0x02 and dst port 80' | awk '{print $4}' | tr . ' ' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | awk ' {print $2 "\t" $1 }'
tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20
2012-06-18 19:27:54
User: jseidl
Functions: egrep ftp tcpdump
1

Simple TCPDUMP grepping for common unsafe protocols (HTTP, POP3, SMTP, FTP)

tcpdump -w - |pv -bert >/dev/null
2011-12-14 00:24:02
User: h3xx
Functions: tcpdump
7

Real gurus don't need fancy tools like iftop or jnettop.

tcpdump -i eth0 -n | head
2011-12-06 18:34:51
User: anarcat
Functions: tcpdump
0

Sometimes it is useful to have just a general picture of "what is taking all the bandwidth here". Running this command will limit tcpdump to a few packets (instead of flooding your terminal endlessly) and will provide a small, but sometimes sufficient, sample to determine what is going on.

Useful to quickly diagnose DOS attacks.

tcpdump -nr capture.file | awk '{print }' | grep -oE '[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}' | sort | uniq -c | sort -n
2011-06-16 19:27:11
User: shahabv
Functions: awk grep sort tcpdump uniq
Tags: tcpdump
0

We can get useful statistics from tcpdump with this simple command.

Thanks "Babak Farrokhi" to teaching me this ;)

tcpdump -w "$(sed 's/-//gi; s/ /_/gi'<<<"-vvv -s0 -ieth1 -c10 icmp").pcap"
sudo tcpdump -i eth0 -s 65535 -A -ttt port 11211
dsniff -i any 'tcp port pop3'
2

dsniff is general purpose password sniffer, it handles *lots* of different protocols, but it also handles tcp-style expressions for limiting analyzed traffic - so I can limit it to work on pop3 only.

tcpdump -i eth0 "tcp port pop3 and ip[40] = 85 and ip[41] = 83" -s 1500 -n -w "sniff"
2010-11-18 09:03:08
User: ironmarc
Functions: tcpdump
0

The command is useful for monitoring the use of the boxes and their connection IP.

Result file "sniff" is readable with GUI program "wireshark" or through CLI with the command:

tcpdump -f "sniff" -XX

tcpdump -i any -n tcp[13] == 2
sudo tcpdump -nnvvXSs 1514 -i lo0 dst port 5432
2009-12-18 17:12:44
User: ethanmiller
Functions: sudo tcpdump
1

It's certainly not nicely formatted SQL, but you can see the SQL in there...

tcpdump -v -i <INTERFACE> -s 0 -w /tmp/sniff.pcap port <PORT> # On the remote side
2009-12-17 22:08:30
User: sputnick
Functions: tcpdump
Tags: tcpdump pcap
4

Then hit ^C to stop, get the file by scp, and you can now use wireshark like this :

wireshark /tmp/sniff.pcap

If you have tshark on remote host, you could use that :

wireshark -k -i <(ssh -l root <REMOTE HOST> tshark -w - not tcp port 22)

The last snippet comes from http://wiki.wireshark.org/CaptureSetup/Pipes

tcpdump -ieth0 -n tcp port 80 -A -s1500
2009-12-05 00:59:16
User: guelfoweb
Functions: tcpdump
Tags: tcpdump
2

Sniffing traffic on port 80 only the first 1500 bytes

tcpdump -n -v tcp or udp or icmp and not port 22
sudo tcpdump -i en1 -n -s 0 -w - | grep -a -o -E "Host\: .*|GET \/.*"
2009-04-04 01:41:48
User: peterc
Functions: grep sudo tcpdump
-2

Replace "en1" with your network interface (on OS X, usually en0, en1, eth0, etc..)