Hide

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again.

Delete that bloated snippets file you've been using and share your personal repository with the world. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

If you have a new feature suggestion or find a bug, please get in touch via http://commandlinefu.uservoice.com/

Get involved!

You can sign-in using OpenID credentials, or register a traditional username and password.

OpenID
or
Sign in Register

First-time OpenID users will be automatically assigned a username which can be changed after signing in.

Hide

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for:

Hide

News

2011-03-12 - Confoo 2011 presentation
Slides are available from the commandlinefu presentation at Confoo 2011: http://presentations.codeinthehole.com/confoo2011/
2011-01-04 - Moderation now required for new commands
To try and put and end to the spamming, new commands require moderation before they will appear on the site.
2010-12-27 - Apologies for not banning the trolls sooner
Have been away from the interwebs over Christmas. Will be more vigilant henceforth.
2010-09-24 - OAuth and pagination problems fixed
Apologies for the delay in getting Twitter's OAuth supported. Annoying pagination gremlin also fixed.
Hide

Tags

Hide

Functions

Hide

Credits

Site by David Winterbottom (user root).

Commands tagged tcpdump

Commands tagged tcpdump from sorted by
Terminal - Commands tagged tcpdump - 17 results
tcpdump -s 1024 -l -A -n host 192.168.9.56
2013-02-02 22:29:52
User: wejn
Functions: host tcpdump
Tags: http tcpdump
-1
Up
Down
Show header HTTP with tcpdump

This is a better way to do the "src X or dst X" filter; plus you might not want to bother with DNS lookups (-n).

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -s 1024 -l -A src 192.168.9.56 or dst 192.168.9.56
2013-02-01 15:03:12
User: bleiva
Functions: tcpdump
Tags: http tcpdump
0
Up
Down
Show header HTTP with tcpdump

Where src or dst is the host that you want to view the HTTP header.

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -ntr NAME_OF_CAPTURED_FILE.pcap 'tcp[13] = 0x02 and dst port 80' | awk '{print $4}' | tr . ' ' | awk '{print $1"."$2"."$3"."$4}' | sort | uniq -c | awk ' {print $2 "\t" $1 }'
2012-08-22 21:26:10
User: efuoax
Functions: awk sort tcpdump tr uniq
Tags: awk uniq tcpdump print
1
Up
Down
Read a tcpdump file and count SYN packets to port 80, Order column by destination.
Comments (1) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20
2012-06-18 19:27:54
User: jseidl
Functions: egrep ftp tcpdump
Tags: grep tcpdump pentest
0
Up
Down
Plaintext credentials sniffing with tcpdump and grep

Simple TCPDUMP grepping for common unsafe protocols (HTTP, POP3, SMTP, FTP)

Show sample output | Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -w - |pv -bert >/dev/null
2011-12-14 00:24:02
User: h3xx
Functions: tcpdump
Tags: tcpdump pv network performance networking
6
Up
Down
Show network throughput

Real gurus don't need fancy tools like iftop or jnettop.

Show sample output | Comments (4) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -i eth0 -n | head
2011-12-06 18:34:51
User: anarcat
Functions: tcpdump
Tags: tcpdump ddos dos diagnostic
0
Up
Down
see what traffic is mostly hitting you

Sometimes it is useful to have just a general picture of "what is taking all the bandwidth here". Running this command will limit tcpdump to a few packets (instead of flooding your terminal endlessly) and will provide a small, but sometimes sufficient, sample to determine what is going on.

Useful to quickly diagnose DOS attacks.

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -nr capture.file | awk '{print }' | grep -oE '[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}' | sort | uniq -c | sort -n
2011-06-16 19:27:11
User: shahabv
Functions: awk grep sort tcpdump uniq
Tags: tcpdump
0
Up
Down
get useful statistics from tcpdump (sort by ip)

We can get useful statistics from tcpdump with this simple command.

Thanks "Babak Farrokhi" to teaching me this ;)

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -w "$(sed 's/-//gi; s/ /_/gi'<<<"-vvv -s0 -ieth1 -c10 icmp").pcap"
2011-05-03 20:44:01
User: brejktru
Functions: tcpdump
Tags: sed tcpdump
0
Up
Down
Make a quick network capture with tcpdump to a file - filename based on tcpdump arguments

The tcpdump arguments are just an example.

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
sudo tcpdump -i eth0 -s 65535 -A -ttt port 11211
2011-03-10 08:20:00
User: kineticrick
Functions: sudo tcpdump
Tags: tcpdump memcache
2
Up
Down
Watch memcache traffic

View all memcache traffic

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
dsniff -i any 'tcp port pop3'
2010-11-18 09:43:40
User: depesz
Tags: tcpdump mail mailboxes pcap wireshark tshark sniff pop3 authentication
2
Up
Down
Sniff ONLY POP3 authentication by intercepting the USER command

dsniff is general purpose password sniffer, it handles *lots* of different protocols, but it also handles tcp-style expressions for limiting analyzed traffic - so I can limit it to work on pop3 only.

Show sample output | Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -i eth0 "tcp port pop3 and ip[40] = 85 and ip[41] = 83" -s 1500 -n -w "sniff"
2010-11-18 09:03:08
User: ironmarc
Functions: tcpdump
Tags: tcpdump mail mailboxes pcap wireshark tshark sniff pop3 authentication
0
Up
Down
Sniff ONLY POP3 authentication by intercepting the USER command

The command is useful for monitoring the use of the boxes and their connection IP.

Result file "sniff" is readable with GUI program "wireshark" or through CLI with the command:

tcpdump -f "sniff" -XX

Show sample output | Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -i any -n tcp[13] == 2
2010-01-21 14:18:16
User: wincus
Functions: tcpdump
Tags: tcpdump networking
0
Up
Down
show tcp syn packets on all network interfaces
Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
sudo tcpdump -nnvvXSs 1514 -i lo0 dst port 5432
2009-12-18 17:12:44
User: ethanmiller
Functions: sudo tcpdump
Tags: tcpdump postgresql
1
Up
Down
Watch postgresql calls from your application on localhost

It's certainly not nicely formatted SQL, but you can see the SQL in there...

Comments (1) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -v -i <INTERFACE> -s 0 -w /tmp/sniff.pcap port <PORT> # On the remote side
2009-12-17 22:08:30
User: sputnick
Functions: tcpdump
Tags: tcpdump pcap
4
Up
Down
Sniffing network to generate a pcap file in CLI mode on a remote host and open it via local Wireshark ( GUI ).

Then hit ^C to stop, get the file by scp, and you can now use wireshark like this :

wireshark /tmp/sniff.pcap

If you have tshark on remote host, you could use that :

wireshark -k -i <(ssh -l root <REMOTE HOST> tshark -w - not tcp port 22)

The last snippet comes from http://wiki.wireshark.org/CaptureSetup/Pipes

Show sample output | Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -ieth0 -n tcp port 80 -A -s1500
2009-12-05 00:59:16
User: guelfoweb
Functions: tcpdump
Tags: tcpdump
2
Up
Down
Capture data in ASCII. 1500 bytes

Sniffing traffic on port 80 only the first 1500 bytes

Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
tcpdump -n -v tcp or udp or icmp and not port 22
2009-09-04 09:23:52
User: opexxx
Functions: tcpdump
Tags: tcpdump
-2
Up
Down
show all upd tcp an icmp traffic but ssh
Comments (0) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate
sudo tcpdump -i en1 -n -s 0 -w - | grep -a -o -E "Host\: .*|GET \/.*"
2009-04-04 01:41:48
User: peterc
Functions: grep sudo tcpdump
Tags: Network Os X grep tcpdump
-2
Up
Down
Show live HTTP requests being made on OS X

Replace "en1" with your network interface (on OS X, usually en0, en1, eth0, etc..)

Show sample output | Comments (3) | Add to favourites | Report as malicious | Submit alternative | Report as a duplicate